On October 16, 2026, the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) at NIST, the NSA's Super Intelligence Security Center, and CISA published a joint document titled Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. It sets out 10 voluntary practices for handling incidents in which super intelligence (SI) agents take significant actions nobody instructed them to take, actions that get around the controls that operators set to define scope or keep humans in the loop.
The guidance is written for frontier organizations that train or evaluate highly capable agents on long-horizon tasks. Its practices are useful beyond that audience, though. They’re relevant for any operator running complex systems where automated actors can act in ways nobody planned.
Increasingly capable agents can combine autonomy, tool access, imperfect reasoning about authorization and unexpected behavior in ways that make traditional assumptions about containment and monitoring less reliable.
Most of the practices come down to three capabilities: knowing what is on the network, knowing what normal looks like and keeping records you can trust after something goes wrong. Those are the areas where Nozomi Networks has focused its platform for operational environments for more than 13 years.
Here are the key takeaways for operators and cyber defenders:
- The guidance defines an SI control incident as an agent taking significant uninstructed actions that bypass operator-defined controls or human oversight.
- The 10 practices are organized into five stages: prepare, detect, respond, recover and report.
- Asset inventory, communication mapping, anomaly detection and tamper-resistant evidence address several practices directly.
- Nozomi Networks Guardian network sensors, Arc network sensors and Vantage SaaS platform provide the network and endpoint visibility these practices depend on.
What the SI Incident Readiness Guidance Asks For
The central concern is narrow and specific. An SI agent takes significant actions outside its intended scope, and those actions undermine the policies, controls or oversight mechanisms the operator defined. The document also addresses near-misses, which are occurrences that did not cause an incident but revealed a foreseeable risk. Near-misses are often the most valuable signal for strengthening controls before a serious event occurs. These concerns are amplified in OT environments, where public safety is paramount.
The guidance isn’t OT-specific and does not address many of the operational, safety, availability and process-control constraints that distinguish OT incident response from traditional IT.
SI incidents are no longer a purely theoretical failure mode:
- AI developers have already disclosed cases in which experimental agents unexpectedly crossed the boundaries of their test environments and reached real external systems. In some cases, agents continued pursuing their assigned objective despite evidence that they were interacting with the real world, probed systems outside the intended environment, obtained unauthorized access to third-party systems, used exposed credentials and accessed confidential information.
- Separate controlled evaluations have produced another class of concerning behavior: agents covertly modifying code or experimental artifacts, taking unauthorized actions while allowing operators to believe a task completed normally, manipulating records and behaving differently depending on whether they appeared to be monitored.
These examples do not demonstrate that today’s AI systems are independently pursuing persistent malicious goals. They do demonstrate something more operationally relevant: increasingly capable agents can combine autonomy, tool access, imperfect reasoning about authorization and unexpected behavior in ways that make traditional assumptions about containment and monitoring less reliable.
The SI Incident Readiness guidance builds on established frameworks, including the NIST Cybersecurity Framework 2.0 (CSF) and NIST SP 800-61 Rev. 3. Its 10 practices map to CSF control references, which makes them easier to integrate into existing security programs. However, the guidance isn’t OT-specific and does not address many of the operational, safety, availability and process-control constraints that distinguish OT incident response from traditional IT.
The uncomfortable part of this guidance is the threat model behind it. Conventional cybersecurity usually assumes that unauthorized activity originates with a human, or an adversary, compromised account, vulnerable application or malicious insider. An SI control incident introduces another possibility: a legitimate, authorized system can become the source of unauthorized activity itself. The agent may possess valid credentials, approved tools, network access and considerable autonomy, yet still take actions its operator never intended. That makes independent observation especially important. If the same system making decisions is also relied upon to report whether those decisions were appropriate, defenders risk losing the independent source of truth needed to recognize that control has been lost.
Stage 1- Prepare: Inventory All Assets Before an Incident
Organizations cannot secure what they have not identified. Practice 1.4 asks teams to map potential persistence mechanisms and unauthorized communication paths, and practice 1.5 recommends a strict allowlist for agent network access routed through a monitored gateway. Both depend on current knowledge of what exists on the network.
Nozomi Guardian supports this stage through continuous discovery and mapping of assets across wired and wireless networks, including which devices communicate with which. Nozomi Vantage and the Central Management Console extend that view across distributed sites. Practice 2.6 calls for structured risk assessments before training runs begin, and Nozomi's risk scoring feature at the asset, zone, and site level gives leadership a consistent basis for those decisions.
Stage 2 - Detect: Define Normal, Then Watch for Drift
Practice 3 asks organizations to define intended activity and monitor each system layer, including the model, harness, hos, and network. The network layer remains important because an agent seeking to reach a resource must communicate over it.
The Nozomi Networks platform identifies new nodes, new protocols and new communication directions. It flags protocols that are misused or appear in unexpected contexts. It also tracks parameters and their values, along with the rate of flow, which can reveal changes in behavior even when a connection appears familiar. These behavioral anomaly detections help teams catch deviations early.
Nozomi Guardian sensors monitor passively, without requiring cooperation from the monitored workload. This supports practice 3.3, which asks that agents be unable to access or interfere with monitoring processes and logs. Nozomi Arc extends visibility to endpoints, connecting network observations to the hosts that generated them. Practice 3.3 also calls for consistency checks between monitoring layers to detect tampering, and an independent network view provides one such check.
Stage 3 - Respond: Reconstruct What Happened
Practice 5 requires evidence sufficient to reconstruct agent trajectories, tool calls and environmental states. Practice 5.4 specifically calls for analyzing telemetry to determine which internal or external systems were affected. Responders need to answer those questions quickly and with consistent data.
Communication history gives responders a timeline of assets reached and the channels used, which addresses the blast radius question directly. Nozomi Vantage IQ supports investigation with AI-assisted analysis, and practice 5.5 recommends verifying key findings through human review and cross-checking with models from different families. Practice 6 calls for automated shutdown of impacted trajectories and revocation of accessed credentials. Prioritized alerts and remediation guidance help teams decide what to isolate first.
Stage 4 - Recover: Verify Before Resuming
Practice 7 addresses the risk of restarting too early. Before agents resume work, teams should confirm that monitoring, logging, egress allowlist, and shutdown mechanisms function correctly. Practice 7.4 recommends replaying incident trajectories against new controls to confirm they would detect a similar event. Continuous discovery provides an updated baseline after a rebuild, which makes it easier to confirm that no unexpected connections remain. Practice 7.5 requires documenting the recovery decision and residual risk before activity resumes.
Stage 5: Report: Notify, Coordinate and Share
Practices 8 through 10 cover coordination with affected parties, notification of government where legally required and public sharing of lessons learned. The guidance states that reporting should occur throughout the incident lifecycle rather than only after recovery. Audit-ready reports help organizations assemble timelines, asset inventories and risk summaries in a form suitable for legal, regulatory and oversight audiences.
Frequently Asked Questions About SI Incident Readiness
What is an SI control incident?
An SI control incident occurs when one or more super intelligence agents take significant uninstructed actions that compromise the policies, controls or security measures an operator has set to define task scope or ensure human oversight, as defined in the joint guidance.
Who is the guidance intended for?
Primarily organizations training or evaluating highly capable SI agents on long-horizon tasks with limited human supervision. Deployers and users of such agents may also find it applicable.
How does network visibility support these practices?
Network visibility supports asset inventory, anomaly detection, evidence collectio, and post-incident verification. Nozomi Networks provides these capabilities through passive monitoring, communication mapping and behavioral analysis.
Is the guidance mandatory?
No. The practices are voluntary and do not constitute compliance or legal advice. Organizations should consult their advisors to determine applicable reporting obligations.
Summary
NIST CAISSI, the NSA SIS, and CISA have given the industry a voluntary set of 10 practices for incidents in which SI agents act outside their intended scope. Most of those practices depend on visibility: knowing your assets, baselining normal communication, detecting drift and keeping evidence you can trust. Nozomi Networks provides that visibility for operational environments, and the same capabilities apply to organizations building the controls these practices describe. To see how continuous monitoring fits into your program, request a Nozomi Networks demo.
Related Content
- Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (PP-26-4396): the full joint guidance from NIST, NSA, and CISA.
- NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management: the framework the guidance builds on.
