Summary
- Security researcher Bruce Schneier attended the [un]prompted AI security conference in San Francisco, describing it as a dense, substantive three-day event.
- Schneier proposes that AI security breaks into three distinct domains: security of AI, security with AI, and security from AI.
- He argues researchers and practitioners need to be clear about which domain they are working in — and that the community as a whole must address all three.
- Schneier presented on the concept of 'integrous AI' at the event; that talk has not yet been published.
- No specific vulnerabilities or incidents were disclosed — this is a framework and community-building story, not an active threat advisory.
A conference worth noting
Bruce Schneier, a well-regarded voice in security research, recently attended the [un]prompted AI security conference held in San Francisco. He described the event as three days of substantive talks covering a broad range of AI security topics. While the conference itself is not a household name, the framework Schneier drew from it deserves attention from security leaders trying to organise their thinking around AI risk.
Three domains, one discipline
Schneier's central observation is that AI security is not a single field but three related ones, each requiring different expertise and carrying different organisational implications. The first is security of AI — that is, protecting AI systems themselves from attack, manipulation, or compromise. The second is security with AI — using AI as a tool to improve defensive and offensive security capabilities. The third is security from AI — addressing the threats that AI creates or enables against people, organisations, and society.
Why the distinction matters
On the surface, these three domains may seem like variations on a theme. In practice, they point to quite different problems, different skills, and different budgets. A team focused on hardening a machine learning pipeline is doing something fundamentally different from a team deploying AI-assisted threat detection, which in turn differs from the work of assessing how adversaries are using AI to sharpen phishing campaigns or accelerate vulnerability research. Conflating them leads to muddled investment decisions and gaps in coverage.
Security of AI: the model and the pipeline
Protecting AI systems involves concerns such as model integrity, adversarial inputs, training data poisoning, and the security of inference infrastructure. As organisations embed AI into critical workflows — from fraud detection to access control — the attack surface of those models becomes a genuine enterprise risk. This domain is still maturing, and many organisations have not yet incorporated AI-specific threat modelling into their security programmes.
Security with AI: augmenting the defender
Using AI to improve security operations is now common in vendor offerings, from anomaly detection to automated triage. Schneier notes this was well represented at the conference. For CISOs, the practical questions here are about trust, explainability, and integration — not just whether a tool works, but whether it can be audited and whether it introduces new dependencies or failure modes.
Security from AI: the threat landscape is shifting
This third domain may be the most challenging to scope. It encompasses the ways in which AI lowers the barrier for attackers, enables new forms of deception, and creates systemic risks that do not map neatly onto existing frameworks. Social engineering, synthetic media, and AI-accelerated exploit development all fall here. It also raises questions about accountability and governance that go beyond the traditional security function.
What is not yet known
Schneier mentioned he gave a talk on integrous AI at the conference but had not yet published it at the time of writing. The substance of that talk is not available. The source material does not detail specific findings, vulnerability disclosures, or technical research from the conference beyond this framework.
Why it matters
CISOs are increasingly asked to have a view on AI — by boards, by regulators, and by their own teams — but the conversation is often imprecise. Schneier's three-domain framework provides a practical tool for structuring that conversation and identifying where your organisation actually has coverage and where it does not. If your security programme addresses AI only as a capability to adopt (security with AI) but not as a system to protect (security of AI) or a threat vector to defend against (security from AI), you have material gaps. This framework is not new science, but it is a useful prompt for a structured internal review.
What to do now
- Use the three-domain framework — security of AI, security with AI, and security from AI — to audit where your current AI security efforts sit and identify uncovered areas.
- Ensure AI-specific threat modelling is included in security assessments for any critical system that incorporates machine learning or AI-driven decision-making.
- Review whether your team has the distinct skills each domain requires, as the expertise needed to harden an ML pipeline differs from that needed to assess AI-enabled social engineering threats.
- Monitor for publication of Schneier's integrous AI talk, which may provide further substantive guidance once available.
