Enterprise cybersecurity leaders are being presented with a growing number of alliances, coalitions and platform partnerships designed to address the risks posed by frontier AI and increasingly advanced autonomous agents.
There is good reason for the emergence of multiple efforts to tackle AI cybersecurity defense, given the scope of the challenge. No single vendor, cloud provider or industry group can independently keep pace with AI-accelerated vulnerability discovery and exploitation.
But for enterprises already struggling with sprawling security stacks, legacy applications and slow change-management cycles, the expanding alliance landscape can make it difficult to decide which initiatives are appropriate for their business and how overlapping offerings fit together.
The Industry Is Building Shared Defenses for AI Security
The response to AI security risks is emerging in collaborative initiatives designed to identify vulnerabilities, strengthen the software supply chain and make lessons from individual incidents reusable across the industry.
Anthropic’s Project Glasswing is using advanced AI models to identify large numbers of vulnerabilities across software and infrastructure, while bringing external organizations into the effort to test and improve defenses. The project reflects a growing recognition that AI can be used to find vulnerabilities in ways that traditional security teams may struggle to match.
IBM and Red Hat’s Project Lightwell takes a different approach, focusing on the security of open-source software. Backed by a $5BN investment, the initiative aims to accelerate vulnerability remediation and reduce the dependence of security fixes on lengthy software upgrade cycles. The initiative is particularly relevant to enterprises where open-source components are embedded deep within customer-facing and business-critical systems.
The Athena coalition, led by Chainguard, is also targeting the software supply chain. Its members use AI to identify vulnerabilities in open-source projects and coordinate remediation, with the initiative expanding the number of vulnerabilities it can process and bringing technology, financial services and enterprise organizations into the effort. Chainguard has joined AWS Security Hub Extended as a partner, making it easier for customers to adopt specific preventative controls through existing cloud security and procurement processes.
The Open Secure AI Alliance is approaching the challenge from an incident-response perspective. Its members have proposed Shared AI Findings Exchange (SAFE) guidelines through a Linux Foundation Request for Comments, creating a framework for organizations to confidentially share information about AI incidents and near misses. The proposal is designed to help identify recurring control failures, notify affected organizations and turn individual incidents into reusable security guidance across the ecosystem.
Other initiatives are tackling the problem from different angles, including shared approaches to reporting AI incidents, model security, provenance and governance.
The Growing AI Security Ecosystem Could Create Enterprise Choice Overload
The various efforts indicate that AI security is becoming a collective infrastructure challenge rather than something individual enterprises can solve through controls around a single model or application.
But the growing number of separate initiatives creates a potential dilemma for enterprises. An enterprise may encounter an industry coalition promising intelligence sharing, a cloud platform offering a marketplace-integrated supply-chain tool, an open community developing AI incident-sharing guidelines, a systems integrator offering patch deployment services and a network-security provider offering interim mitigations.
Brian Gracely, Senior Director of Portfolio Strategy at Red Hat, acknowledged in an interview with CX Today that customers could face short-term uncertainty:
“There’s probably going to be some short term, ‘hey, there’s a lot of options out there. Which one should we pick?’”
Gracely’s view is that competition should ultimately improve the support available to enterprise customers.
