CYBRARY Standards we bind to
Cyber-range guidance and AI-security guidance both exist, but they are distributed across several bodies and nobody has consolidated them into an end-to-end AI cyber-range specification. Rather than wait, we publish the profile we build against and version it with the content.
| Body | Framework | Version | What it drives |
|---|---|---|---|
| NIST | AI Risk Management Framework + Generative AI Profile | 1.0 / GAI profile | Risk framing, control categories and the evidence we export for governance reviews. |
| NIST / NICE | Workforce Framework for Cybersecurity | SP 800-181r1 | Work roles plus Task, Knowledge and Skill statements behind every lab outcome. |
| MITRE | ATLAS | current | Adversarial ML and AI-system technique mapping for each attack path. |
| MITRE | ATT&CK Enterprise | current | Conventional technique mapping where the AI incident crosses into endpoints, identity and network. |
| OWASP | Top 10 for LLM Applications and Agentic Risks | current | Vulnerability classification for prompt injection, excessive agency, output handling and supply chain. |
| ISO/IEC | 42001 AI management systems | 2023 | Governance scenario design and the assurance evidence pack. |
| ISO/IEC | 23894 AI risk management | 2023 | Risk-treatment vocabulary shared with customer GRC teams. |
| OpenTelemetry | GenAI semantic conventions | current | Trace Explorer span shape, so learner-visible traces match production tooling. |
| 1EdTech / ADL | xAPI and LTI | xAPI 1.0.3 / LTI 1.3 | Learning records and LMS interoperability for enterprise customers. |
Job routing: what a model is allowed to do
Every AI call in the range is classified before it is routed. Ground truth is pinned to the deterministic runtime in all configurations, including the ones where a customer supplies the model.
Flags, permissions, check results and authoritative range state. Never produced by a model, in any runtime.
deterministic
Simulated coworkers, managers, customers and attackers talking to the learner.
deterministic · chrome-builtin · byok · org-gateway · cybrary-managed · hybrid
Explaining a trace or nudging a stuck learner. Personal projection only — never shared range state.
deterministic · chrome-builtin · byok · org-gateway · cybrary-managed · hybrid
Draft feedback on a learner's incident report, always alongside the deterministic rubric result.
deterministic · byok · org-gateway · cybrary-managed · hybrid
Rewording of injects and phishing lures around a fixed objective set. Server-approved candidates only in shared ranges.
deterministic · org-gateway · cybrary-managed · hybrid
Maturity levels
- Level 1 — AI-aware lab
- • A model or AI concept appears inside a guided exercise
- • Static or deterministic scoring
- • Limited enterprise context
- Level 2 — AI application lab
- • The learner interacts with an AI-enabled application
- • Prompt, retrieval, model and tool traces are visible
- • Attack and remediation are both validated
- Level 3 — Enterprise AI scenario
- • AI is wired to identity, data, applications, endpoints and security tools
- • Business consequences and multiple stakeholders exist
- • Multiple valid defensive paths are accepted
- • Security and utility regression are both measured
- Level 4 — Team AI range
- • Multiple human roles work concurrently
- • Adaptive but bounded injects and communications
- • Individual and team performance are both evaluated
- • Facilitator control, replay and after-action tooling
- Level 5 — Continuous AI assurance range
- • Humans and autonomous agents can both be evaluated
- • Models, prompts, policies, datasets and tools are continuously regression tested
- • Results are comparable across versions
- • Deployment gates can consume the evidence
- • Organization-specific digital twins and control validation
Definition of done for an AI lab
- Teach systems, not prompt tricks. Real AI security depends on identity, authorization, data, tools, application code, monitoring and recovery.
- Score outcomes, not clicks. Multiple defensible investigation and remediation paths are accepted.
- Measure security and utility together. A control that makes the AI useless is not a production solution, and the scoreboard says so.
- Treat AI output as probabilistic. Repeated trials, reported variance.
- Version everything. Model, prompt, tools, data, policies, evaluators and scenario seeds are part of the lab release.
- Keep ground truth outside the model. No model ever remembers a flag, a permission, a solution or authoritative range state.
- Make consequential actions inspectable. Complete provenance from input through retrieval, policy, identity, tool and enterprise effect.
- Use AI variation around an authored core. AI varies people, timing, noise and wording; assessed objectives and ground truth stay controlled.
- Design for model replacement. Labs survive provider and model changes.
- Build safety into orchestration. Cost, permissions, egress, destructive effects, data exposure and human approval are range primitives.