Penta Security, AUTOCRYPT unveil AI-era cybersecurity declaration

Penta Security and AUTOCRYPT have released a joint “Declaration on Cybersecurity” in Seoul to define core principles for defending systems as AI becomes a tool for attacks and control. The framework focuses on observability, cross-layer defense and zero-damage design, with an emphasis on protecting both digital and physical systems.

Why it matters: - Penta Security and AUTOCRYPT are trying to define a common security framework for an AI era where attacks can be automated and harder to predict. - The declaration targets both digital systems and Physical AI, where cyber threats can affect real-world operations and control. - The companies say the framework is meant to help organizations preserve control, accountability and core functions even when AI is involved.

What happened: - Penta Security and AUTOCRYPT announced the “Declaration on Cybersecurity” in Seoul on Oct. 27, 2026. - The declaration was developed by cybersecurity experts from both companies. - Eight experts participated, including Seokwoo Lee, Duksoo Kim and Taegyun Kim, along with specialists in cryptography, software engineering, information security, security software strategy and development, and Physical AI. - The announcement was jointly made on Oct. 5 by AUTOCRYPT and Penta Security leaders and research heads.

The details: - The declaration begins with the line, “AI has begun to hack autonomously.” - The experts argue that AI-driven cyber threats require consistent principles that can be applied across situations, instead of separate countermeasures for each attack type. - The core framework is called the “Three Principles of Cyber Defence.” - Observability focuses on measuring and analyzing cybersecurity-related information. - Cross-Layer Defence protects attack surfaces at every layer and coordinates defenses across them. - Zero Damage Design aims to prevent cyberattacks from causing actual damage. - The declaration says cybersecurity should be treated as a fundamental component of every digital system. - The declaration says defenses must leave no gaps. - The declaration says security should be built in from the design stage. - The framework also addresses the risk that AI safety criteria could be circumvented or fail to work as intended. - The proposal includes external controls for AI cybersecurity risks, including verifying and controlling AI actions and clearly designating accountable parties. - Duksoo Kim said the security impact of AI is extending into the physical world as AI becomes involved in decision-making and control of physical systems. - Taegyun Kim said cybersecurity in the AI era must help systems retain control, accountability structures and core functions. - Taegyun Kim said the declaration is meant to start discussion on the technological and institutional principles needed to use AI safely.

Between the lines: - The declaration is less about one product and more about setting a policy and engineering baseline for AI security. - The focus on design-stage security suggests the companies see prevention and resilience as more important than reactive patching. - The emphasis on external control mechanisms signals concern that AI systems may not reliably self-police in high-risk environments.

What's next: - Penta Security and AUTOCRYPT are positioning the declaration as a reference point for future technical and institutional debate on AI safety. - The companies have not announced a formal enforcement mechanism, but the framework could shape how they and others talk about AI cybersecurity requirements going forward.

The bottom line: - Penta Security and AUTOCRYPT want cybersecurity standards for the AI era to be built around observability, layered defense and damage prevention before AI systems fail in the real world.