AI Can Change After Launch. NIST Says Security Must Keep Watching
drift
A change in an AI system’s behavior after it is deployed.
post-deployment monitoring
Checking an AI system after people begin using it.
alert fatigue
Missing important warnings because too many alerts arrive.
What the interview examined
Federal News Network interviewed Kat Megas, director of NIST’s AI Accelerator. NIST is the U.S. National Institute of Standards and Technology. Megas discussed how generative AI is changing cybersecurity. This is not a report about one cyber incident. It is a practical view of risks organizations should consider when adopting AI. Read the interview
Why AI needs a new risk mindset
Generative AI has made more leaders ask how AI will help their organizations. They also ask how it might create new security risks. Megas said organizations must understand that AI is not always predictable like traditional software. Traditional software usually follows written logic. AI may produce different results from similar tasks. That difference changes how teams should test and manage it.
Drift makes launch day only the beginning
Megas highlighted drift, which means an AI system’s behavior changes over time. A system may look safe during early tests. Its behavior may later move away from what teams expected. This is why post-deployment monitoring matters. Organizations should decide what to measure. They should compare later behavior with an earlier baseline. They also need a plan for responding to important changes.
Lessons from connected devices
Megas connected this problem with NIST’s earlier work on Internet of Things security. Organizations sometimes did not know exactly which devices were on their networks. New devices can expand what must be protected. But the problem is not only technical. Communication can fail between the people who use devices and the people who manage security. That gap can hide problems.
How AI can help defenders
AI can also support cybersecurity teams. Megas said it can help discover weak points and prioritize which issues deserve attention first. It may help with alert fatigue, when people receive so many warnings that important ones become harder to notice. NIST’s Cyber AI Profile was presented as a way to organize useful defensive applications.
What is established
The interview clearly supports three ideas. Organizations should monitor AI after launch. They should know what devices connect to their networks. They should improve communication across teams. AI can support security work, but its own behavior still needs review.
What remains unknown and what to watch
The article does not provide a rate for drift. It does not identify one best monitoring measure. It does not show results from a large deployment of the Cyber AI Profile. This is expert guidance, not proof that one process works everywhere. Next, watch whether organizations make monitoring part of normal operations. The real test is continued measurement, clear ownership, and human review when an AI system changes.
AI Safety Checks Must Continue After Launch
📰 Full story: AI Can Change After Launch. NIST Says Security Must Keep Watching
NIST says AI can change over time. Organizations should keep measuring it after launch.
drift
A change in an AI system’s behavior over time.
post-deployment monitoring
Checking an AI system after launch.
alert fatigue
Having so many warnings that important ones are harder to notice.
💡 The gist
- NIST says AI needs checks after launch.
- AI behavior can change over time.
- AI can help sort security warnings.
Federal News Network interviewed Kat Megas, an AI program leader at NIST. NIST is a U.S. technology agency. Read the interview
Generative AI has changed how organizations discuss security. Leaders ask how AI might help. They also ask how it might create new risks.
Traditional software usually follows written steps. People can often predict its results. AI is less predictable. The same task may produce different results. Its behavior may also change later. This change is called drift.
Testing AI before launch is not enough. A system can pass an early test and need attention later. Organizations should measure its behavior after launch. They should compare new results with a starting measure. This is called post-deployment monitoring.
Kat Megas also discussed lessons from connected devices. Some organizations did not know every device on their networks. New devices can expand what must be protected. Poor communication can make these problems harder to find.
AI can help defenders. It can help find weak points. It can help rank which problems matter most. It can also sort many warnings. This may reduce alert fatigue.
Still, the interview has limits. It gives expert advice, not results from one large experiment. It does not say how often drift happens. It does not prove one method works everywhere. It also does not promise that AI will make security automatic.
Next, organizations should make monitoring part of normal operations. They should keep a list of connected devices. Teams should share information. They should use AI as support, with people checking the results.
AI Helpers Need Checkups
📰 Full story: AI Can Change After Launch. NIST Says Security Must Keep Watching
An AI helper may change over time. People need to watch it.
NIST
A U.S. group that studies technology.
AI
A computer helper that can do tasks.
The big idea
- AI helpers do jobs for people.
- Their answers may change later.
- People should check them again and again.
NIST is a U.S. group that studies technology. Kat Megas leads an AI program there. Federal News Network is a news site. It asked her about safe AI. The interview
Some computer programs follow the same steps. AI may answer differently later. It can change while people use it.
So people should not test it once and forget it. They should look at its answers after launch. They should notice when something changes.
People should also know which machines connect to their network. Forgotten machines can cause trouble.
AI can help sort many warning messages. But people still need to watch the helper. A helpful computer still needs grown-ups nearby.