On AI Security

Simply using security and privacy benchmarks (standardized tests that measure how well a system performs) is not enough to ensure AI is truly secure, because benchmarks don't accurately measure AI capabilities. Instead of relying on benchmarks alone, organizations should apply proven security engineering practices, such as process-driven standards like BSIMM (Building Security In Maturity Model, a framework that guides companies through security best practices), while staying extra vigilant since AI systems don't have a single reliable security measurement like software does.