- NSA has released new guidance on best practices for cyber hygiene
- The guide addresses adversaries using AI to automate cyber intrusion techniques
- It recommends immediate steps such as network inventory, multi-factor authentication and patching
The National Security Agency has released a cybersecurity information sheet outlining cyber hygiene practices intended to help organizations defend networks against artificial intelligence-enhanced cyber threats.
With AI changing how adversaries conduct cyber operations, intelligence organizations also are reassessing their approaches to data, cyber capabilities and secure information-sharing. The Potomac Officers Club’s 2026 Intel Summit is happening Sept. 24 — in less than a month — bringing senior intelligence community leaders and industry partners together to discuss these priorities. Register now to secure your spot.
What Cybersecurity Risks Does the NSA Guidance Address?
NSA said the guidance, titled “Best Practices for Cyber Hygiene,” outlines measures to address cybersecurity weaknesses that adversaries can exploit with AI-enabled techniques.
Threat actors are exploiting weak cyber hygiene by using AI to automate each stage of the intrusion lifecycle, according to the agency. The guidance identifies unpatched systems, misconfigured networks and weak authentications as key vulnerabilities, along with default configurations, poor network segmentation and weak monitoring practices.
Which Cyber Hygiene Practices Does NSA Recommend?
The guidance calls for organizations to maintain network inventories, use multifactor authentication and apply security patches as foundational cybersecurity measures. NSA also recommends network segmentation and continuous monitoring as part of zero trust practices.
These measures are intended to address tactics that AI can make faster or easier to execute, including automated reconnaissance and “living off the land,” in which adversaries use legitimate tools or capabilities already available within a network.
NSA developed the recommendations using its Top Ten Cybersecurity Mitigation Strategies, National Institute of Standards and Technology guidance and the Department of War chief information officer’s Brilliant at the Basics initiative.
The agency noted that the practices do not address every possible attack vector and should be combined with other measures to safeguard networks.
What Recent AI-Enabled Threats Has NSA Identified?
The new guidance follows an August cybersecurity advisory from NSA and other agencies warning that threat actors were using AI-generated exploitation scripts to conduct targeted reconnaissance against Siemens S7 Series programmable logic controllers. The actors disguised the scripts as legitimate monitoring tools while targeting industrial environments.
The advisory recommended applying security patches, isolating devices from the internet where possible, using strong access controls and monitoring industrial control system environments for suspicious activity. Those measures overlap with several of the cyber hygiene practices outlined in NSA’s latest guidance.
The new CSI also adds to NSA’s previous work on AI security. In 2025, the agency and international cybersecurity partners issued guidance on protecting data used during the development, testing and operation of AI systems, including recommendations involving data provenance, digital signatures and trusted infrastructure.
