Sixty-plus cybersecurity providers in 17 countries have committed to a new industry charter for AI use — a signal of how quickly vendors want to get ahead of the governance question before regulators do it for them.
The CREST AI Charter, published today by the international not-for-profit membership body CREST, sets out nine principles for responsible AI adoption in cybersecurity services. The founding cohort covers the full range of service types: penetration testing, vulnerability assessment, incident response, threat intelligence, security operations, and application security testing.
The urgency behind it is data-driven. CREST's own research found that 69% of providers are now using AI in daily service delivery, with 76% increasing their AI use over the past year. Adoption is concentrated in reporting (47%) and vulnerability scanning and enumeration (44%) in penetration testing — the lower-stakes, higher-volume tasks where automation carries least risk if it goes wrong.
The nine principles span accountability and governance, transparency of use, documentation and assurance, human oversight, data sovereignty, security and confidentiality, secure development of AI tooling, supply chain assurance, and resilience. They draw on CREST's technical working groups and reference the UK Government Office for Science's AI 2030 scenarios.
Cybersecurity is an unusual context for this kind of standard: providers are regularly granted privileged access to sensitive systems, which means an AI tool behaving unexpectedly mid-engagement carries higher stakes than in most other industries. The Charter's focus on supply chain assurance and client-side data sovereignty reflects that exposure directly.
CREST plans to develop formal standards alongside the Charter, run collaborative working groups, and publish independent research. It says it will add further signatories beyond the founding 60.
To stay across the latest in cloud, AI, and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at comparethecloud.net/newsletter
