> ## Content Index > Fetch the complete content index at: https://www.cybrsecmedia.com/llms.txt > Use this file to discover other available public pages before exploring further. # HITRUST Expands AI Security Certification and Risk Tools - URL: https://www.cybrsecmedia.com/hitrust-expands-ai-security-certification-and-risk-tools/ - Published: 2026-10-15T13:52:01.000Z - Updated: 2026-10-15T13:54:21.000Z - Description: HITRUST expands AI security certification, adds agentic AI controls and automates third-party risk assessments and report sharing. - Author: Bill Brenner - Tags: AI security certifications, AI Security, Article, HITRUST HITRUST is expanding its cybersecurity assurance capabilities with new AI security controls, automated risk assessment tools and verified certification report sharing, as organizations struggle to keep pace with the security challenges created by artificial intelligence and increasingly complex supply chains. The company announced the enhancements Thursday, October 15, including updates to its HITRUST Common Security Framework (CSF), an AI-powered security questionnaire tool and a centralized platform for sharing validated assurance reports. The changes are designed to address a growing problem for enterprise security teams: Traditional third-party risk management processes, often built around lengthy questionnaires and periodic assessments, are struggling to keep up with AI adoption, expanding vendor ecosystems and emerging threats. HITRUST pointed to the 2026 Verizon Data Breach Investigations Report, which found that 48% of breaches involved a third party, a 60% increase from the previous year. "In an AI world, trust can't be built on static questionnaires and point-in-time checks. Assurance has to evolve as fast as the threats and technologies it validates," said Toby Bussa, director of product marketing at HITRUST. [Subscribe to the CYBR.SEC.Media newsletter](#/portal/signup/free) ## New security controls target agentic AI and post-quantum threats A central component of the announcement is HITRUST CSF version 11.9, which expands the framework's coverage to include agentic AI, AI vulnerability research and post-quantum encryption. The updated framework supports HITRUST's AI Security Assessment and Certification program, which incorporates 55 AI-specific control requirements mapped to more than a dozen security threats involving generative AI, large language models and autonomous AI agents. The objective is to give organizations independently validated evidence of their AI security controls rather than relying solely on internal assessments or vendor claims. That distinction matters as AI agents gain access to enterprise systems, sensitive information and operational workflows. Organizations increasingly need ways to demonstrate that AI deployments meet defined security requirements, particularly when customers and business partners demand evidence of effective risk management. ## AI automation aims to cut questionnaire workloads HITRUST is also introducing MyCSF Questionnaire Responder, an AI-powered capability that uses existing HITRUST assurance evidence to complete security and privacy questionnaires. According to the company, the tool can answer up to 70% of common security and privacy questions with 90% accuracy when supported by an r2 assessment. For a typical 80-question questionnaire, HITRUST estimates that the capability could save approximately seven hours of manual work, reducing a process that previously took days to minutes. The approach addresses a longstanding bottleneck in third-party risk management. Security teams frequently spend substantial time responding to overlapping vendor assessments, collecting evidence and validating answers across different customer requirements. By grounding responses in previously validated assurance evidence, HITRUST aims to reduce repetitive work while maintaining accountability for the information being shared. ## Verified reporting addresses evidence authenticity The third component, Report Center, provides a secure mechanism for sharing current HITRUST certification reports directly with authorized recipients. Reports are watermarked and distributed through HITRUST, giving recipients a way to verify their origin and reducing the manual exchanges typically involved in proving certification status. The capability is particularly relevant as AI-generated content raises questions about the authenticity of documents and supporting evidence used in security assessments. Together, the new tools reflect a broader shift in cybersecurity assurance: Moving beyond periodic compliance exercises toward processes that can provide more timely, verifiable evidence of security controls. HITRUST also cited its 2026 Trust Report, which found that 99.62% of HITRUST-certified environments did not report a breach in 2025\. That figure provides context for the company's assurance model, although certification does not eliminate cybersecurity risk. ## What's next HITRUST AI Security Assessment and Certification, CSF v11.9 and Report Center are available now. MyCSF Questionnaire Responder will enter early access on October 26, with general availability scheduled for January 2027. For organizations evaluating the new capabilities, the immediate questions will be how effectively the expanded AI controls address emerging agentic threats, whether automated questionnaire responses reduce assessment workloads in practice, and how readily customers and partners adopt verified report sharing. The larger challenge remains unchanged: As AI systems gain autonomy and third-party relationships grow more complicated, enterprises will need stronger evidence that the technologies and vendors they depend on can be trusted. [![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/2026/10/2027-Events-Banner-34.png)](https://www.cybrsecmedia.com/conference/)