Open Secure AI Alliance: The Other Half of the Job
Nvidia, Cisco, IBM and more than fifty companies in total have put an open defence stack for AI agents into the commons. OnStak's Raghav Srinivasan calls it the right move, and necessary. His point is about what comes next: shared tooling can show you what your AI did, but only your own organisation can say whether it was right.
On 27 July, more than fifty technology companies — among them Nvidia, Cisco, IBM, Microsoft, CrowdStrike, Palo Alto Networks, Red Hat, Hugging Face, HPE and Dell — launched the Open Secure AI Alliance, formed to ensure defenders everywhere have open, frontier tools they can trust and control. It sits alongside the Linux Foundation's existing open source security work, and its members also intend to help educate policymakers and regulators on the state of AI security.
What's in it is more than a statement of intent. The alliance starts from the position that AI safety needs the full agent stack — identity, permissions, harnesses, guardrails, logs and evaluation — and the day-one contributions reflect that range. Nvidia's NOOA is an open research framework that helps harnesses integrate better with models, to improve how agent behaviour can be tested and governed. HPE brought SPIFFE and SPIRE, zero-trust identity standards for cryptographically verifying AI agents. Hugging Face contributed Safetensors, a safe format for storing model weights. Microsoft's MDASH is a multi-model agentic scanning harness that orchestrates specialised agents for vulnerability discovery, and IBM and Red Hat contributed Lightwell, extending security across open source supply chains with digitally signed patches.
It lands days after this month's Hugging Face breach, the incident we covered in Episode 4, where an agentic system reached another company's live production systems on its own, in hours. Nvidia's announcement points to incidents like it as evidence for why this work matters. Raghav puts the connection more strongly, and it's his read rather than the alliance's own framing: "this alliance was born from a breach."
Raghav Srinivasan, who heads our Digital Resilience practice, is unambiguous that this is a good thing, and he isn't hedging when he says it. AI as it exists today is still very much ungoverned. Traditional governance frameworks were never designed for non-human actors operating at machine speed, and getting fifty-odd companies who compete with each other to publish defensive tooling in the open, rather than each quietly rebuilding the same primitives, is not a small piece of work.
Why AI failure doesn't look like software failure
Where he'd add something is on the shape of the problem the tooling is pointed at, and it's worth slowing down on. When a conventional application fails, it tells you. It throws an exception, drops the request, trips a monitor, wakes someone up. The whole discipline of production engineering is built on the assumption that failure announces itself.
An AI system that goes wrong often does none of that. It returns a well-formed, fluent, entirely plausible answer that happens to have drifted from the policy you set, or invented a fact, or quietly committed you to a decision you wouldn't have signed off on. Nothing crashes. No alarm goes off. The output looks exactly like the thousands of correct outputs either side of it.
Here's the honest boundary, and it isn't a criticism of the alliance. Open tooling can give you the instrumentation — the traces, the logs, the evaluation hooks, the audit trail — and the alliance is genuinely putting that in reach of everyone. What no shared toolkit can supply is your definition of correct. A trace can tell you exactly what an agent did. It cannot tell you whether that answer was right for your business, your policy, your regulator, your customer. That judgement is local, and unlike a scan or a signature it never finishes running.
Which is why he won't let the two ideas sit in separate meetings. Security and observability are not separate conversations anymore. If security protects the AI, observability is what lets you trust it, two sides of the same coin. AI is highly capable of pursuing legitimate goals in unintended ways if we do not design, observe and govern it properly.
There's a third piece he'd add, and it's the one the executive table actually asks for: evidence. Observability provides the visibility. Security delivers protection. AI Assurance brings governance and trust. Composed rather than bought separately, those three are what we mean by Digital Resilience, and together they answer the only question that matters once something is live: can we trust this in production, and can we prove it?
So the shared work and the local work fit together rather than compete. The alliance is strengthening how AI gets built, shipped and instrumented, which makes everyone's Day-0 and Day-1 sturdier. Composing that into an operating model that keeps proving itself — after the pilot succeeds, while the system is simply running — is Day-2, and Day-2 is where it stops being an industry problem and becomes yours.
Which leaves a good question to take into your own estate this week, and a more answerable one than it was a week ago: if one of your production models started being confidently wrong tomorrow morning, how long would it take anyone to notice?
Production AI is a team sport. Now the team needs to be able to observe the field.
Quick answers
What is the Open Secure AI Alliance?
The Open Secure AI Alliance launched on 27 July 2026, formed to ensure defenders everywhere have open, frontier tools they can trust and control. Nvidia's announcement names more than fifty founding participants, including Microsoft, IBM, Cisco, CrowdStrike, Palo Alto Networks, Red Hat, Hugging Face, HPE and Dell. They are developing and sharing open technologies, techniques and tools to safeguard software and agents. It sits alongside the Linux Foundation's existing open source security work, and its members also intend to help educate and inform policymakers and regulators on the state of AI security.
What does the Open Secure AI Alliance actually cover?
The alliance describes an open defence stack for agents, spanning identity and isolation through to safe model formats, multi-model scanning and secure coding workflows, on the premise that AI safety requires the full agent stack: identity, permissions, harnesses, guardrails, logs and evaluation. Day-one contributions include Nvidia's NOOA, an open research framework that helps harnesses integrate better with models to improve agent testability and governance; HPE's SPIFFE and SPIRE, zero-trust identity standards for cryptographically verifying AI agents; Hugging Face's Safetensors, a safe format for storing model weights; Microsoft's MDASH, a multi-model agentic scanning harness that orchestrates specialised agents for vulnerability discovery; and Lightwell from IBM and Red Hat, extending security across open source supply chains with digitally signed patches.
Who is in the Open Secure AI Alliance, and who is missing?
Nvidia's announcement names more than fifty founding participants, spanning chipmakers, hyperscalers, security vendors and large enterprises; press coverage has reported lower figures, from 37 upwards, depending on how membership is counted. OpenAI, Google, Meta and Anthropic are not on Nvidia's list. Several other model developers are, including Mistral, Perplexity, Reflection AI and Thinking Machines Lab.
Is the Open Secure AI Alliance enough on its own?
It is a substantial step, and it covers considerably more than perimeter security: the contributed tooling reaches into identity, isolation, scanning, and the harnesses that make agent behaviour easier to test, trace, audit and govern. What a shared toolkit cannot supply is the part specific to you. Instrumentation can tell you what your AI did; only your own organisation can define what it should have done, against your policy and your business outcomes. Turning open tooling into a running assurance that your systems still behave the way you intended is the work that stays with the enterprise.
What is the difference between AI security and AI observability?
AI security keeps attackers, malicious inputs and unauthorised access away from the model, the infrastructure and the data. AI observability tells you what the system is actually doing once it is running: what it was asked, what it answered, what it did next, and whether that still matches the policy you wrote. Security protects the AI. Observability is what lets you trust it. You cannot secure or optimise what you cannot observe.
What is Digital Resilience for AI?
Digital Resilience is how production AI keeps earning its place. It composes three disciplines that are usually run and bought separately: observability provides the visibility, security delivers protection, and audit-grade AI Assurance brings governance and trust. Composed rather than bolted together, they answer the question an executive team actually asks once a system is live: can we trust this in production, and can we prove it? At OnStak it is run as a practice, owned by Raghav Srinivasan.
Full transcript
The next big AI failure won't be a breach. Nothing will crash. No alarms will go off. Your AI will just quietly make a decision it shouldn't and look perfectly confident doing it.
85% of organizations have experienced an AI incident within 12 months of launch, and up to 100% of cloud provider guardrails were defeated in simulated trials. That should be a wake up call to every cloud AI practitioner.
The Open Secure AI Alliance is the right move. AI as it exists today is still very much ungoverned. Traditional governance frameworks were not designed for non-human actors operating at machine speeds.
I have said it before. Production AI is a team sport, and security may be the one part you can least afford to play alone. So Nvidia, Cisco, IBM, the thirty-plus companies committing to build AI security tooling in the open. Very good. Necessary, even. But it's only half the story.
This alliance was born from a breach. It's built to stop the last failure. Protecting the model, infrastructure and data, all are important. But AI doesn't fail like a traditional application. It can return an answer that looks perfectly valid while drifting away from policy, introducing hallucinations, or making poor business decisions.
And again, I cannot stress this enough. You cannot secure what you cannot observe.
Security and observability are not separate conversations anymore. If security protects AI, observability helps you trust it. Two sides of the same coin for building resilient AI systems.
That's the real lesson here. AI is highly capable of pursuing legitimate goals in unintended ways if we do not design, observe and govern them properly. And production AI is a team sport. Now the team just needs to be able to observe the field.
Transcribed from the final published edit (2:36). Caption corrections applied: "Open Secure AI Alliance", "ungoverned", "afford", "simulated trials", "Nvidia".
Go deeper
More from OnStak on running AI safely and in production.
About OnStak
The OnStak AI Portfolio underpins your AI operating model. OnStak builds the technology and services that move AI from pilot to production — that is how OnStak reduces the engineering effort to operationalize AI. Almost fifteen years migrating the unmovable, modernising the untouchable, and fixing the data everyone gave up on. 75% of OnStak's workforce are AI architects and engineers; 30+ enterprise AI deployments across Healthcare, Finance, Public Sector, Manufacturing, and Retail.
Explore the OnStak AI Portfolio →