When the Agent Is the Incident: NIST, NSA, and CISA's 10 Key Practices for SI Incident Response

Sun, 25 Oct 2026 00:00:00 +0000

Every incident response playbook you’ve ever written assumes the same cast. There’s an attacker, there’s a target, and there’s you in between. On October 16, 2026, NIST, NSA, and CISA published guidance for an incident where that cast breaks down: the thing you’re responding to is the agent you deployed, doing something nobody told it to do.

That’s the core idea in Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. It’s voluntary, it’s 14 pages, and it’s the clearest statement yet from the U.S. government that agent misbehavior is an incident class of its own, not a footnote to prompt injection.

NIST CAISSI on CybersecurityOS

When the Agent Is the Incident: NIST, NSA, and CISA's 10 Key Practices for SI Incident Response