# AI Security evidence notes — v2

## Evidence policy

- **A**: official standards/specifications, versioned official documentation, peer-reviewed primary research, public code, or reproducible primary evidence.
- **B**: authoritative official material with clear scope but limited independent validation.
- **C**: vendor product pages, releases, roadmaps, talks, hiring, organizational signals and unilateral cases.
- **D/E**: commercial proposals, rankings, second-hand claims or statements without methods. These seed candidates, not conclusions.

## v2 evidence backbone

1. NIST's May 2026 agent-security RFI analysis says foundational cybersecurity remains relevant but needs adaptation for AI agents; identity, standards, implementation guidance and evaluations are active gaps.
2. NIST's Agent Standards Initiative and NCCoE concept paper elevate agent identification, authorization, auditing and non-repudiation into first-class controls.
3. Official MCP guidance defines concrete implementation risks: confused deputy, token passthrough, OAuth metadata SSRF, session hijacking, unsafe local servers and scope inflation.
4. OWASP's 2026 agentic and MCP guidance supplies application and engineering views, while MITRE ATLAS remains the threat-technique knowledge layer.
5. AgentDojo, InjecAgent, AgentHarm and CyberSecEval 2 show that security evaluation must preserve benign utility while measuring unsafe actions, data exfiltration, harmful task completion and false refusal.

## Russia evidence boundary

- Positive Technologies: product/R&D signals in AI-for-security and industrial AI.
- Kaspersky: AIST is a clear Security-for-AI research/capability seed.
- BI.ZONE: shipped assistant plus a multi-agent SOC/AI Pentest roadmap; autonomy and outcome metrics remain unverified.
- UserGate: dedicated AI-security product ownership and product/research direction announced on 30 June 2026; this is incubation evidence, not a shipped AI-security platform.
- Solar: shipped AI-for-security features in SIEM and AppSec; productivity and accuracy claims remain vendor-reported.
- InfoWatch: product page explicitly covers preventing sensitive-data transfer to public AI services; broader agent/model/runtime security is not established.

## Customer-provided proposal boundary

The IIDF proposal is commissioning context only. It proposes five Russian companies, a two-month study, a 30–40 slide report, an Excel base and 3–5 interviews. It does not define a ranking metric, test protocol or evidence grade. The workbench therefore uses an evidence-graded candidate pool, recommends 8–12 interviews for deep research, and treats all vendor claims as hypotheses until triangulated or tested.

## Forbidden wording

- “Russia's Top-5 AI Security companies” without an explicit metric and scored longlist.
- “Unique”, “first”, “leading”, “autonomous” or “production-ready” based only on vendor material.
- “Secure” based only on attack blocking without benign-task utility and false-blocking results.
- “MCP-compliant therefore secure”; protocol compatibility and implementation security are separate.