HITRUST adds AI security tools & third-party risk updates

HITRUST has introduced new products and updates focused on AI-related security assurance and third-party risk management, expanding its cybersecurity certification framework and related tools.

The additions include broader AI and post-quantum coverage in HITRUST CSF v11.9, an AI-based questionnaire response tool in MyCSF, and a report-sharing service called Report Centre. The changes are intended to address gaps in how organisations assess security risks linked to AI systems and external suppliers.

Businesses are facing a growing volume of security reviews as AI adoption widens and software supply chains become more complex. HITRUST cited industry data showing AI-related breaches rose 61% year on year, while 26% involved third-party software-as-a-service providers. It also pointed to research showing 48% of breaches involved a third party, up sharply from the previous year.

That backdrop has increased pressure on established vendor assurance methods, which often rely on manually completed questionnaires and controls not designed for AI use cases. Many current AI risk assessments, HITRUST said, focus either on governance alone or on a narrow category of AI, leaving gaps in coverage.

AI assessment

At the centre of the update is the HITRUST AI Security Assessment and Certification, which HITRUST described as an approach built specifically for AI security. It includes 55 AI-specific control requirements mapped to more than a dozen AI security threats spanning generative AI, large language models and agentic AI.

The latest version of the HITRUST CSF also adds coverage for agentic AI, AI vulnerability research and post-quantum encryption. The changes extend the framework beyond its previous focus and reflect demand from security buyers for suppliers to demonstrate controls around newer technologies.

HITRUST has long been associated with healthcare compliance and third-party assurance, but now works across a broader range of industries. Its framework is used by organisations seeking independently validated certification for supplier reviews, procurement checks and broader cyber risk management programmes.

Questionnaire burden

The second part of the launch targets a routine pain point for security and compliance teams: answering due diligence questionnaires from customers and partners. MyCSF Questionnaire Responder uses AI and an organisation's existing HITRUST assurance evidence to complete responses to common security and privacy questions.

According to HITRUST, the tool can answer up to 70% of common questions with 90% accuracy when used with an r2 assessment. On an 80-question form, that could save about seven hours otherwise spent drafting responses and gathering supporting evidence.

HITRUST is positioning the product as a way to reduce the operational burden on teams handling a growing number of reviews. It also argues that using previously validated assurance evidence may provide a more consistent basis for responses than starting each questionnaire from scratch.

Report sharing

The third element, Report Centre, is designed to streamline how certification reports are exchanged between organisations. Instead of being forwarded manually between parties, current HITRUST certification reports can be shared directly with recipients.

Reports distributed through the service are watermarked and delivered directly from the organisation, according to HITRUST. The feature is aimed at addressing concerns about authenticity as AI-generated content becomes harder to distinguish from verified records. It could also reduce the back-and-forth often involved in proving assurance status during supplier reviews.

Toby Bussa, Director of Product Marketing at HITRUST, said the changes reflect a need for security assurance to adapt to the speed of AI adoption and the risks that come with it. "In an AI world, trust can't be built on static questionnaires and point-in-time checks. Assurance has to evolve as fast as the threats and technologies it validates," Bussa said.

He said HITRUST sees certification, automation and direct evidence-sharing as connected parts of the same problem. "A HITRUST certification is one of the most trusted signals of security an organization can hold, and we're making it work harder for our customers. It covers the AI systems they're deploying, answers security questionnaires in minutes and puts verified evidence in the right hands," Bussa said.

HITRUST also cited internal figures showing that 99.62% of HITRUST-certified environments did not report a breach in 2025.