\cleardoublepage \part{Foundations} \setbookpart{Foundations}

Part I: Foundations

AI can only be an active part of cyber defence if the organisation knows what it defends against, which framework it measures itself by and on which platform its security AI runs. This part establishes those foundations before Parts II to VII work through the six CSF Functions.

Chapter 1 explains why defenders can no longer treat AI only as something to protect, and Chapter 2 gives the defender's picture of AI-enabled attackers from observed threat intelligence. Chapter 3 presents CSF 2.0 as the organising frame, with the three focus areas of the NIST Cyber AI Profile and the mapping of CSF outcomes to NIS 2, DORA, the Cyber Resilience Act, the AI Act and ISO/IEC 27001. Chapter 4 places security AI on the reference architecture of AI Platform and Security, with sovereignty over security data.

What you will learn in this part:

• What the evidence shows about AI-enabled attackers
• How CSF 2.0 and the Cyber AI Profile organise the book
• A reference architecture that treats security AI as AI