AI Security Standards
CIS Controls AI Companion Guides, security control mapping, and Benchmark-style guidance for emerging AI systems.
Leader, CIS AI Benchmarks Community
Andrew Dannenberger
AI Security Standards
Securing the space between AI capability and real-world action.
I build AI security standards. I authored the CIS MCP Server Benchmark v1.0.0, published September 2026. Now, as a member of the CIS Benchmark Development Team and Leader of the CIS AI Benchmarks Community, I lead the next CIS Benchmarks for AI systems.
profile, zsh
$ whoami andrew-dannenberger $ cat profile.json { "focus": "Building AI Security Standards", "role": "CIS Benchmark Development Team", "standards": "Principal Co-author, CIS v8.1 MCP Guide", "specialties": ["MCP", "Security Controls", "Agentic AI"], "based": "Chicago Area / Remote", "latest": "Author, CIS MCP Server Benchmark v1.0.0", "currently": "Leader, CIS AI Benchmarks Community" }
Highlights
Leader CIS AI Benchmarks Community
Author CIS MCP Server Benchmark v1.0.0 (opens in a new tab)
Principal Co-author CIS Controls v8.1 MCP Companion Guide (opens in a new tab)
Collaborator CIS Controls v8.1 AI/LLM Companion Guide (opens in a new tab)
Collaborator CIS Controls v8.1 AI Agents Companion Guide (opens in a new tab)
CIS Webinar From Prompts to Protocols: The Security Blueprint for Enterprise AI (opens in a new tab)
Podcast Guest TopCyberPro, CIS AI Papers Discussion (opens in a new tab)
How AI Systems Work
The AI Action Pipeline
Modern AI systems move from model inference through agentic reasoning, MCP tool calls, and data retrieval, gated by human review, before taking real-world action. Understanding this flow is the foundation of AI security.
AI System Flow
Model Context Protocol Input Model LLM inference
Logic Agent reasoning
Protocol MCP Tools dispatch
Context Data retrieval
Control Gate Human Review approval
Output Action execute
Observe Audit Log record
Human control gate
MCP Protocol boundary
Action output
This diagram is a simplified educational overview of how AI, agents, and
MCP interact. Real deployments vary significantly.
Point of View
How I Think About AI Security
A few convictions that shape how I approach AI security standards.
Guidance has to be implementable
Security guidance only reduces risk when teams can actually configure, check, and audit it. That is why I focus on Benchmarks and concrete control mappings, not abstractions.
Most AI failures happen at a boundary
Prompt injection, confused-deputy access, over-scoped tools: the dangerous failures live at the seams between instruction and data, model and tool, agent and action. Securing those boundaries matters more than hardening the model alone.
Recommendations must be auditable
If a team cannot check whether a recommendation is in place, it is advice, not a control. I write every recommendation with an audit procedure and a remediation path, so compliance can be proven instead of assumed.
Human approval is a control, not a speed bump
Human-in-the-loop is most valuable exactly when an agent can take an action it cannot take back. Designed deliberately, it is a control point worth keeping, not friction to engineer away.
Expertise
What I Work On
Building the security standards that let organizations configure, verify, and audit AI systems.
MCP & Agentic AI Security
Tool governance, least privilege, prompt and resource exposure, approval flows, confused deputy risk, and auditability across MCP ecosystems.
CIS AI Benchmarks
Author of the published CIS MCP Server Benchmark v1.0.0. Now leading the CIS AI Benchmarks Community: scoping the next AI Benchmarks, running consensus review, and publishing prescriptive recommendations with audit and remediation guidance.
Applied AI Systems
Internal platform MCP concepts, agentic AI architectures, and secure AI implementation patterns.
Published Work
Selected Work
Standards authorship and CIS AI Benchmarks leadership.
Public Author
CIS MCP Server Benchmark v1.0.0
Center for Internet Security · Released September 2026
Authored the first CIS Benchmark for MCP servers: 55 prescriptive, vendor-neutral recommendations across 10 security domains, each with rationale, audit procedures, and remediation guidance.
MCP Security Security Benchmarks Authorship
Public Principal Co-author
CIS Controls v8.1 MCP Companion Guide
Center for Internet Security · April 2026
Translated MCP-specific risks, tool invocation, authorization, confused-deputy patterns, and third-party server governance, into practical control-aligned guidance across all 18 Controls.
MCP Security Controls Mapping Authorship
Ongoing Leader
CIS AI Benchmarks Community
Center for Internet Security · Ongoing
Officially leading the CIS AI Benchmarks Community as part of the CIS Benchmark Development Team, setting scope, running consensus feedback cycles, and driving the publication roadmap for AI security standards.
Security Benchmarks Standards Community
Help build the next AI security standards
Interested in contributing to the CIS AI Benchmarks Community, collaborating on AI security standards, or having me speak on AI, MCP, and agentic AI security Benchmarks? Let's talk.