HITRUST Innovations Validate Trust in the AI Era
New capabilities across AI security certification, AI-powered questionnaire response and verified report sharing help prove trust as fast as AI
Frisco, Tx., Oct. 15, 2026
HITRUST, the leader in validated cybersecurity assurance, today announced new capabilities that help organizations establish and verify trust as AI reshapes third-party risk and the supply chain. Capabilities include expanded agentic AI and post-quantum coverage in HITRUST CSF v11.9, the AI-powered Questionnaire Responder in MyCSF and Report Center for trusted report sharing. Driven by HITRUST's continued investment in innovation, these capabilities make validated assurance more relevant, easier to use, more cost-effective and more trustworthy.
AI adoption and vendor tool sprawl are growing the attack surface faster than traditional risk management can respond. AI-related breaches rose 61% year over year, and 26% involved third-party SaaS. The 2026 Verizon Data Breach Investigations Report found that 48% of breaches involved a third party, up 60% from the prior year. Most third-party risk management still relies on manual questionnaires and one-size-fits-all assessments that take days to complete and were not built for AI. As AI takes hold, hallucinations and unverified source data demand greater oversight of the assurance process.
“In an AI world, trust can’t be built on static questionnaires and point-in-time checks. Assurance has to evolve as fast as the threats and technologies it validates,” said Toby Bussa, Director of Product Marketing at HITRUST. “A HITRUST certification is one of the most trusted signals of security an organization can hold, and we’re making it work harder for our customers. It covers the AI systems they’re deploying, answers security questionnaires in minutes and puts verified evidence in the right hands.”
Assurance Built for AI and Emerging Risk: HITRUST AI Security Assessment and Certification
Most AI security and risk assessments cover only broad AI governance or specific types of AI. The HITRUST AI Security Assessment and Certification is the industry's only assurance approach built specifically for AI security. It includes 55 harmonized, AI-specific control requirements, mapped to more than a dozen AI security threats spanning GenAI, LLMs, and agentic AI.
The latest version of HITRUST CSF, v11.9, adds coverage for agentic AI, AI vulnerability research and post-quantum encryption. Organizations get independently validated, certifiable proof that their AI systems are secure, so customers and regulators can trust the AI they deploy and speed up AI sales and adoption.
Automating the Questionnaire Burden: MyCSF Questionnaire Responder
MyCSF Questionnaire Responder leverages AI and an organization's existing HITRUST assurance evidence, to answer security questionnaires in just a few clicks, cutting response time from days to minutes. With an r2 assessment, it can complete up to 70% of common security and privacy questions with 90% accuracy; on an 80-question questionnaire, that saves about seven hours of answering questions and gathering evidence. Teams can now handle more questionnaires without adding overhead, and because responses are grounded in validated HITRUST assurance evidence, this speed doesn’t come at the cost of accuracy.
Trusted, Verified Evidence Sharing: Report Center
Report Center securely shares current HITRUST certification reports with the right party at the right time. As AI increases concerns around authenticity, proof is essential. Recipients can trust Report Center reports because they are watermarked and come straight from HITRUST. This cuts the manual back and forth of proving assurance between organizations.
Trust in the AI era still has to be verified. HITRUST-certified environments in 2025 had a 99.62% breach-free rate, according to the 2026 HITRUST Trust Report.
Availability
HITRUST AI Security Assessment and Certification, Report Center and CSF v11.9 are available now. Questionnaire Responder enters early access on October 26th, with general availability in January 2027. To learn more, visit hitrustalliance.net/MyCSF or contact sales@hitrustalliance.net.