Research Intelligence Explorer

Agent Authority Boundary

The sequence through which AI influence reaches retrieval, tools, authorization, action, and external consequence.

AI Product Supply Chain

An AI product is composed of models, prompts, policies, data, context, tools, orchestration, infrastructure, evaluations, and generated artifacts.

AI Security Execution Gap

The gap between recognizing AI risk and producing reproducible evidence that an engineered control works.

Inside-Out AI Security Assurance

Security assurance should begin with the system, boundary, and failure path rather than the desired claim.

M.A.D.E.

The durable operating functions of AI Security Engineering.

Role Architecture Follows Risk Architecture

AI security roles should be derived from system exposure, required functions, ownership, team structure, tooling, and evidence obligations.

Signal Divergence

AI Security Engineering is forming through research, building, security, public attention, governance, exploitation, harm, staffing, and funding at different speeds.

AI Security arXiv Corpus 2026

Canonical State 2026 AI-security-tagged arXiv corpus.

AI Security Job Descriptions 2026

Canonical State 2026 ATS job-description corpus.

AI Security Media Corpus 2026

Canonical normalized State 2026 rolling media corpus.

AI-Relevant Vulnerabilities 2026

Strict canonical State 2026 AI-relevant vulnerability corpus.

OpenSSF Repository Snapshot 2026

Canonical State 2026 OpenSSF Scorecard repository snapshot.

Public AI Incidents 2026

Canonical State 2026 public AI incident corpus.

From Risk Architecture to Role Architecture

Canonical figure from The State of AI Security Engineering 2026.

How a Profession Reproduces Itself

Canonical figure from The State of AI Security Engineering 2026.

Institutionalization

Canonical figure from The State of AI Security Engineering 2026.

Outside IN

Canonical figure from The State of AI Security Engineering 2026.

ROLE Compression

Canonical figure from The State of AI Security Engineering 2026.

The Agent Authority Boundary

Canonical figure from The State of AI Security Engineering 2026.

The AI Product Supply Chain

Canonical figure from The State of AI Security Engineering 2026.

The Durable Functions of AI Security Engineering

Canonical figure from The State of AI Security Engineering 2026.

Agentic Anarchy

Agentic product capability is advancing faster than explicit security ownership for identity, tool access, authorization, and external consequence.

Boardroom-to-Backlog Gap

Executive AI risk narratives often fail to translate into named controls, owners, and evidence artifacts at the engineering level.

Entry-Level Extinction

AI security hiring is weighted toward experienced practitioners while the discipline lacks mature entry pathways and workforce infrastructure.

Model Supply Chain Blind Spot

Organizations often treat the model as the AI product while under-modeling the data, context, prompts, tools, orchestration, infrastructure, and generated artifacts around it.

Skill Washing

AI language can appear in security hiring without materially changing the underlying responsibilities, controls, or operating model.

Skills Validation Gap

The market asks for AI security engineering skills before it has standardized, practical evaluation pathways to validate them.

The Adjacent Reservoir

Adjacent engineers — platform, DevOps, and ML engineers without a security background — report low self-rated confidence on AI security tasks (1.25-1.55 of 5, 16-25% confident), but the barriers they report are training and role-definition gaps, not vocabulary or credential gaps.

The Agentic Surface Emergence

Prompt-injection, function-calling, and tool-calling security signals remain a small share of the research and tooling surface today, but are rising quickly.

The Attention Deficit

Across 53,865 analyzed media items, capability coverage outpaces security coverage by roughly 5.0:1 (8,447 capability items vs. 1,682 across every security-labeled bucket combined).

The Builder Vacuum

94.3% of observed repositories in GHArchive's bounded rolling-window sample (412 of 437) remain unclassified as AI-security-specific — the AI-native tooling ecosystem employers ask for barely exists yet.

The Compliance Reflex

Established compliance language substantially outweighs AI-native governance and control vocabulary in hiring language.

The Evidence Gap

Organizations frequently move from policy or tooling claims directly to assurance without demonstrating the control, test, telemetry, and evidence chain.

The Exploited Present

53 AI-relevant CVEs have reached CISA Known Exploited Vulnerability status — actively exploited in the wild today, not a theoretical future risk.

The Framework Paradox

Of 8 tracked AI-native security frameworks, 5 are document-only and only 3 are machine-readable — none are natively integrated into CI/CD pipelines, security tooling, or automated evidence collection.

The Frankenstein Role

AI security hiring often compresses responsibilities historically distributed across several security disciplines into one requisition.

The Frontier Paper Stack

3,411 of 10,152 unique arXiv papers in the current pull are strict AI-security papers, already naming concrete work in prompt/generation security, agentic action security, model and ML attack security, governance assurance, privacy protection, MCP/tool-use security, and red teaming.

The Knowledge Desert

Only 8 Wikimedia pages are narrowly tagged AI-security-specific against a field with 3,411 strict AI-security arXiv papers and 437 classified GitHub repos — there is no canonical public reference for AI security engineering as a practice.

The Privacy Asymmetry

Differential privacy and privacy-preserving ML remain active arXiv research terms (112 and 32 papers in the current pull), but privacy still appears in hiring language mainly as a GDPR/compliance checkbox rather than a named engineering capability.

The Probability Pivot

AI security hiring language increasingly reflects probabilistic systems reasoning and ambiguity tolerance rather than deterministic pass/fail control thinking.

The Red Team Misnomer

AI red teaming is frequently described as a standalone activity even though durable value depends on control engineering, telemetry, replay, remediation, and regression.

The Telemetry Blind Spot

arXiv puts only 1.99% of papers (202 of 10,152) in detection and runtime monitoring, and media coverage of AI cyber defense is just 0.9% of volume (486 of 53,865 items) — among the least-researched and least-covered AI security topics.

The Tool Incumbency Trap

Compliance automation incumbents appear in hiring language more visibly than AI-native security testing and evaluation tooling.

The Unicorn Index

The market prices one role while frequently describing team-level capability breadth, compressing five or more specialties into a single requisition.

The vCISO Vacuum

Some organizations are too small to hire the unicorn role the market has priced, but too exposed to defer AI security entirely.

The State of AI Security Engineering 2026

What companies really mean by AI Security Engineer and why the operating model is lagging the technology.

2,547

AI-Relevant Vulnerability Disclosures

Strict canonical AI-relevant vulnerability population.

3,411

AI-Security Papers

AI-security-tagged papers in the State 2026 research corpus.

27,260

Companies Analyzed

Companies represented in the canonical State 2026 hiring corpus.

39:1

Governance Language Ratio

Established compliance-language prevalence relative to AI-native governance and control vocabulary.

754,507

Job Descriptions Analyzed

Canonical State 2026 hiring corpus.

1,458

Legacy AI-Relevant Vulnerability Count

Superseded by the strict canonical State 2026 vulnerability population.

2,548

Legacy AI-Relevant Vulnerability Count

Superseded by the strict canonical State 2026 vulnerability population.

2,730

Legacy AI-Security Paper Count

Superseded by the canonical State 2026 research corpus.

108:1

Legacy Governance Language Ratio

Superseded by the canonical State 2026 comparison method.

7.6:1

Legacy Governance Language Ratio

Superseded by the canonical State 2026 comparison method.

352,000

Legacy Job Description Count

Superseded by the canonical State 2026 corpus.

98,754

Legacy Job Description Count

Superseded by the canonical State 2026 corpus.

613,416

Legacy Media Corpus Count

Superseded by the canonical normalized State 2026 rolling media corpus.

53,680

Media Corpus Items

Items represented in the State 2026 rolling media corpus.

1,286,572

OpenSSF Repository Snapshot

Repositories represented in the State 2026 OpenSSF snapshot.

1,558

Public AI Incidents

Public AI incidents represented in the State 2026 incident corpus.

Agent Security

Security of AI systems that retrieve, invoke tools, authorize actions, and create external consequences.

AI Red Teaming

Adversarial testing of realistic AI failure paths, authority boundaries, control failures, and external consequences.

AI Security Engineering

The engineering discipline responsible for mapping, attacking, defending, and evidencing the security of AI products and systems.

AI Security Evidence

Reproducible evidence that AI security controls exist, operate, and continue to work.

AI Security Governance

Governance language, control ownership, operating accountability, and defensible security claims for AI systems.

AI Security Institutional Formation

The research, building, security, governance, incident, staffing, and funding systems through which a discipline becomes real.

AI Security Workforce

Hiring, role architecture, skills, seniority, labor supply, and workforce infrastructure for AI Security Engineering.

AI Supply Chain Security

Security of the models, data, prompts, policies, tools, orchestration, infrastructure, and generated artifacts that compose AI products.

AI Vulnerability Intelligence

Vulnerability disclosures, exploited records, weakness patterns, and affected AI product surfaces.

Model and Data Security

Security of model artifacts, training and evaluation data, retrieval sources, embeddings, and model promotion workflows.

Open Source AI Security

Public repository activity, security tooling, OpenSSF controls, and builder behavior across AI security ecosystems.

RAG Security

Security of retrieval-augmented generation systems, including authorization, poisoned context, retrieval abuse, and data exposure.