Cloud Security Alliance Launches CSAI Foundation to Secure the Agentic AI Era

AI Security Series

The Cloud Security Alliance has spent years building the foundational tooling for cloud security governance — the Cloud Controls Matrix, STAR certification, the CAIQ. Now they are making a parallel bet on AI: a dedicated 501(c)(3) nonprofit foundation called CSAI, with a focused 2026 mission of Securing the Agentic Control Plane.

This is not a rebrand or a working group. It is a structurally separate foundation with its own board, funding model, and program portfolio — announced at RSA Conference 2026 and formalized through an April 29 press release that included a CNA authorization, a new catastrophic risk research program, and the acquisition of two open specifications for securing autonomous agents at runtime.

What Is the CSAI Foundation

The Cloud Security AI (CSAI) Foundation is a 501(c)(3) public-interest nonprofit launched by the Cloud Security Alliance. It is dedicated exclusively to AI security and safety, inheriting and accelerating CSA's existing AI Safety Initiative — which had already produced over 30 research white papers, the Trusted AI Safety Expert (TAISE) professional certification, the AI Controls Matrix (AICM), and the STAR for AI organizational certification program before CSAI was formally separated as its own entity.

The foundation's stated purpose is to govern autonomous AI systems through research, education, assurance, and global community. The 2026 mission frames the risk correctly: as enterprises move from experimental AI to autonomous agent-driven transformation, the attack surface shifts from models alone to identity, authorization, orchestration, runtime behavior, and trust assurance across complex agent ecosystems. CSAI is positioning itself as the trust infrastructure layer for that ecosystem — not just defining best practices, but operating the assurance programs that enterprises and auditors will need to certify against.

As of October 2026, the mission dashboard at dashboard.csai.foundation tracks six strategic programs spanning 33 active and planned projects.

The Six Strategic Programs

Each program targets a distinct layer of the agentic security problem. The table below summarizes the scope and status of each.

Program	Focus	Key Outputs
AI Risk Observatory	Real-time visibility into how autonomous agents behave, fail, and introduce risk	RiskRubric.ai leaderboard, agentic CNA, CVE/CWE gap research, structured risk identifiers
Agentic Best Practices	Full lifecycle security guidelines for enterprise agentic deployment	Identity-first controls for non-human actors, runtime authorization governance, open source tool repository
Education, Credentialing & Awareness	Workforce development for securing, auditing, and governing autonomous agent ecosystems	TAISE CxO, TAISE Agentic, TAISE Compass (HS students), Agentic AI Summit Series
CxOtrust for Agentic AI	Executive collaboration translating agentic risk into board-level decisions	Monthly CISO/CIO/CAIO briefings, private roundtables, board-ready risk narratives
Global Assurance & Trust	Extending STAR certification into the agentic era with AI-powered continuous audit	STAR for AI (AICM + ISO 42001/27001/SOC 2), Valid-AI-ted GRC automation engine
Future Forward	Long-horizon research and infrastructure for agent ecosystems and existential risk	CSA Pod agent testbed, TAISE-Agent autonomous agent certification, Catastrophic Risk Annex

AI Risk Observatory

The Observatory is CSAI's threat intelligence function for the agentic era. The core challenge it addresses is that the existing vulnerability ecosystem — CVE, NVD, ISACs — was not designed for agentic behavior. Agent-specific failures (prompt injection chains, unauthorized tool invocation, runtime context manipulation) do not map cleanly to traditional vulnerability categories.

The Observatory's primary outputs include the RiskRubric.ai model scanning leaderboard, integration with incident reporting ecosystems, and a next-generation CVE Numbering Authority scoped specifically on agentic AI. The CNA authorization is covered in the milestones section below.

Agentic Best Practices

This program is building the operational playbook for securing agentic AI at the enterprise level. The stated scope includes security for agentic AI and agentic AI for security, identity-first controls for non-human actors, runtime authorization and privilege governance, agent taxonomy and capability standards, and an open source tool repository. The incorporation of the AARM and ATF specifications (see milestones) gives this program two concrete technical anchors to build from.

Education, Credentialing and Awareness

CSAI is expanding the TAISE certification program in three directions. TAISE CxO targets board and C-suite leaders who need executive-level AI safety credentialing. TAISE Agentic is a practitioner track specifically for teams building and securing autonomous agents. TAISE Compass is a high school curriculum aligned with the White House Task Force for AI Education — a notably early pipeline play from a professional credentialing body.

The Agentic AI Summit Series and ongoing industry surveys round out the awareness function.

CxOtrust for Agentic AI

CxOtrust is an executive collaboration program — monthly briefings on emerging agentic AI risks, private CISO/CIO/CAIO roundtables for peer exchange, and the development of board-ready risk narratives and decision frameworks. The stated goal is to provide a "voice of the enterprise customer" back into CSAI's program activities, which is a useful feedback loop if it functions as advertised.

Global Assurance and Trust

This is CSAI's direct extension of the STAR program model into AI. STAR for AI adds AI-specific certification on top of the AICM, mapping to ISO 42001, ISO 27001, and SOC 2 simultaneously. The STAR Registry is already the world's largest repository of provider assurance documentation; STAR for AI extends that infrastructure to cover AI system trustworthiness.

Valid-AI-ted is the automation engine underneath it — an AI-powered audit tool designed to automate control analysis, cross-framework mapping, scoring of STAR self-assessments, and continuous evaluation of agent behavior and risk posture. The compliance automation use case is well-suited to AI tooling given how much of GRC work is structural mapping between overlapping frameworks.

Future Forward

The Future Forward program addresses the longer horizon. CSA Pod is a live agent interaction environment at pod.cloudsecurityalliance.org serving as a testbed for real-world agent behavior, a telemetry source for the AI Risk Observatory, and a distribution layer for CSA standards. TAISE-Agent extends the TAISE human certification program to autonomous agents themselves — behavioral evaluation through adversarial and scenario-based assessment, continuous re-certification cycles, and machine-readable Agent Trust Profiles.

The Catastrophic Risk Annex (covered in milestones below) is also housed in Future Forward. Aligned external frameworks include NIST AI RMF, ISO 42001, the EU AI Act, CoSAI, and CSA STAR.

April 2026 Milestones

At the CSA Agentic AI Security Summit on April 29, 2026, CSAI announced four significant milestones alongside the foundation's mission formalization.

Catastrophic Risk Annex

Launched with support from Coefficient Giving (a philanthropic organization focused on long-horizon AI safety), the Catastrophic Risk Annex extends the AICM and STAR for AI to scenarios involving loss of human oversight, uncontrolled system behavior, and large-scale irreversible consequences. A four-phase rollout runs from June 2026 through December 2027, culminating in the inaugural State of Catastrophic AI Risk Controls Report. The annex is aligned with NIST AI RMF, the EU AI Act, and ISO/IEC 42001, and focuses specifically on what can actually be tested in production — a practical constraint that distinguishes it from pure theoretical safety research.

CVE Numbering Authority Authorization

CSAI has been authorized by the CVE Program as a CVE Numbering Authority. The initial operational scope covers vulnerabilities in CSA's own software tools, with active work toward agentic-specific vulnerability coordination, addressing gaps in CVE/NVD ecosystem coverage for AI behaviors, and building AI-assisted human-verified vulnerability enrichment capabilities. This is a notable infrastructure move — it positions CSAI to define how agentic vulnerabilities are cataloged and disclosed, which becomes consequential if agentic CVE volume grows as expected.

AARM Specification Acquisition

The Autonomous Action Runtime Management (AARM) specification — an open system specification for securing AI-driven actions at runtime across context, policy, intent, and behavior — was contributed to the CSAI Foundation by Vanta. AARM founder Herman Errico continues to lead the specification as working group chair. AARM is a technically important piece: runtime authorization is the layer where agent behavior actually gets constrained at execution time, and it has been an underspecified gap in most current agentic security frameworks.

Agentic Trust Framework Acquisition

The Agentic Trust Framework (ATF) from Josh Woodruff, a CSA Research Fellow and co-chair of the CSA Zero Trust Working Group, was also transferred to CSAI stewardship. ATF applies Zero Trust principles to agentic AI to provide a governance framework for agent authorization and trust decisions. Woodruff continues to lead development. The Zero Trust lineage here is meaningful — ATF should be structurally compatible with Zero Trust architectures that healthcare organizations have already been building.

The Foundation's Existing Toolset

CSAI did not launch from zero. The AI Safety Initiative's prior outputs are the starting point for the foundation's programs and worth knowing if you are evaluating what is immediately usable.

The AI Controls Matrix (AICM) v1.1 is currently available as a free download from cloudsecurityalliance.org. It contains 243 control objectives across 18 security domains and maps to ISO 42001, ISO 27001, NIST AI RMF 1.0, the EU AI Act, and BSI AIC4. Role-specific implementation and auditing guidelines are available separately for model providers, orchestrated service providers, application providers, AI customers, and cloud service providers. This is not aspirational — it is a working framework with download documentation today.

TAISE (Trusted AI Safety Expert) is an active certification program already enrolling. STAR for AI Level 1 self-assessment submission is operational via the CSA STAR Registry. Both of these are usable now, before the more ambitious programs mature.

What This Means for Healthcare

Healthcare AI adoption has been moving faster than healthcare AI governance — and a dedicated assurance infrastructure for agentic systems addresses a gap that healthcare security teams have had no clean answer to.

AICM as a Procurement and Vendor Assessment Tool

The AICM's role-specific structure (Model Provider, Orchestrated Service Provider, Application Provider, AI Customer) maps directly to healthcare's AI vendor landscape. A hospital deploying an EHR-integrated AI tool is the AI Customer; the EHR vendor integrating a third-party model is the Orchestrated Service Provider. The AICM gives procurement and security teams a structured question set — the AI-CAIQ — that can be incorporated into vendor assessments immediately. The fact that it is free and maps to ISO 42001 and NIST AI RMF makes it compatible with existing risk management programs without requiring a separate framework purchase.

STAR for AI as a Vendor Certification Standard

If STAR for AI gains adoption the way STAR for cloud did, it will eventually become a shorthand expectation in AI vendor contracting — similar to how SOC 2 Type II became a baseline expectation for SaaS vendors. Healthcare security teams should begin incorporating STAR for AI attestation as a preferred (and eventually required) vendor qualification criterion, before it becomes a reactive checkbox exercise during breach investigations.

AARM and ATF for Agentic AI Governance

Healthcare organizations standing up agentic AI — clinical decision support agents, scheduling agents, revenue cycle agents — currently have no widely adopted runtime authorization standard. AARM addresses exactly that gap. A specification for securing AI-driven actions at runtime across context, policy, intent, and behavior is directly applicable to the governance question every healthcare CISO is already asking: how do we know what our agents are actually authorized to do at execution time, and how do we verify it? ATF's Zero Trust lineage makes it compatible with health system Zero Trust programs already in progress.

The CNA Work Has Practical Implications for Patch Management

Agentic vulnerabilities are not currently well-represented in the CVE ecosystem. When a clinical AI agent exhibits unexpected behavior due to a prompt injection chain or context manipulation vulnerability, there is no standard identifier, no CVSS score, no NVD entry for patching prioritization. CSAI's CNA work — even in its early stages — begins to build the cataloging infrastructure that healthcare AI patch management will eventually depend on.

TAISE Agentic for Practitioner Development

The TAISE Agentic certification will be directly relevant to healthcare security and AI governance practitioners responsible for designing, auditing, or overseeing autonomous agent deployments. It is worth tracking for team development planning — particularly for organizations building AI governance programs where credentialing infrastructure for AI-specific security roles is currently thin.

The Bigger Picture

CSAI's formation reflects a structural judgment that the existing security industry — standards bodies, certification programs, vulnerability infrastructure — was not going to organically evolve fast enough to keep pace with agentic AI adoption. Forming a dedicated 501(c)(3) was a way to create focused institutional capacity rather than waiting for existing organizations to route resources toward the problem.

The six-program structure is coherent. Threat intelligence (Observatory), operational guidance (Best Practices), workforce (Education), executive alignment (CxOtrust), assurance infrastructure (STAR for AI), and long-horizon research (Future Forward) cover the lifecycle from detection to governance. The AARM and ATF acquisitions give the Best Practices program concrete technical specifications to build from rather than starting from blank paper.

The near-term question is adoption velocity. The AICM and TAISE have been available for months and have real user bases. Whether STAR for AI reaches the market penetration that made STAR for cloud consequential depends on whether cloud providers and AI platform vendors treat it as a differentiation signal — the same dynamic that drove STAR Level 1 and Level 2 adoption. Healthcare organizations can accelerate that trajectory by asking for STAR for AI attestation in vendor RFPs now, before it becomes standard.

This is an entry in the AI Security series. For related coverage, see Anthropic Expands the Cyber Verification Program to Three Tiers and AI Agent Unintended Actions: What Anthropic and OpenAI's Disclosures Mean for Healthcare.