Cybersecurity Roundup: Partnerships, Funding, and Emerging Threats – December 17, 2025 (NIST, ServiceNow/Armis, AI, Identity, UAV GN&C)

Cybersecurity Roundup — December 17, 2025. An op-ed style daily briefing on NIST’s Cyber AI Profile, ServiceNow’s move into security via Armis, 2026 predictions on identity and the collapse of perimeter thinking, UAV/GN&C cybersecurity, and industry takeaways from cybersecurity leaders. Actionable guidance for CISOs, product leaders, investors, and policy makers.

Executive summary — the short read

Today’s cybersecurity landscape is shaped by two converging forces: rapidly advancing AI capabilities and an accelerating shift from perimeter defenses to identity- and data-centric security postures. NIST’s newly released draft Cyber AI Profile reframes how organizations should secure and govern AI systems—this will become a foundational reference for enterprise risk teams. Strategic consolidation continues: ServiceNow’s acquisition of Armis marks a clear platform play into security instrumentation and observability. Thought leaders are already predicting that identity, AI, and the collapse of perimeter thinking will dominate 2026. Meanwhile, niche technical risks — for example the need to embed cybersecurity into UAV guidance, navigation and control (GN&C) systems — reveal how cyber resilience is now an engineering requirement across domains. Collectively, these stories tell one thing: security has to be rebuilt around identity, provenance, and resilient systems engineering, not fences and checkbox compliance.

Introduction — framing the week’s key trends

The industry woke up this week to a familiar but sharper theme: technology outpaces policy and habit. AI’s arrival into nearly every enterprise workflow forces new security questions—how to secure models, how to use AI defensively, and how to thwart AI-enabled attacks. Regulators and standards bodies are racing to keep up: NIST’s Cyber AI Profile (a draft guidance tied to CSF 2.0) is designed to do exactly that for cybersecurity teams. At the same time, market behavior continues to favor platform consolidation and vertical specialization: ServiceNow’s purchase of Armis is a signal that major enterprise platforms will buy missing security telemetry and device visibility rather than build it from scratch. Predictions for 2026 highlight identity as central: when perimeter thinking collapses, identity becomes the new perimeter. And in domains like unmanned aviation, cybersecurity is no longer an afterthought — it must be engineered into GN&C systems from the ground up. These five items together provide a practical narrative for organizations: adapt controls for AI; adopt identity-first architectures; buy or build deep telemetry; and make security a systems-engineering discipline.

Story 1 — NIST’s Cyber AI Profile: turning AI into a native security concern

What happened

On December 16, 2025, NIST released a preliminary draft of the Cybersecurity Framework Profile for Artificial Intelligence (the Cyber AI Profile), alongside a 45-day public comment window. The profile maps CSF 2.0 to three focus areas: securing AI systems, using AI for cyber defense, and thwarting AI-enabled attacks. It’s explicitly meant to help organizations of all maturity levels incorporate AI-aware strategies into existing cybersecurity programs. The draft will feed into an initial public draft in 2026 following community feedback.

Source: NIST.

Why it matters (opinion)

NIST’s profile is sensible and strategic: rather than inventing AI-only edicts, it integrates AI into the existing Cybersecurity Framework vocabulary (identify, protect, detect, respond, recover). That design choice matters—organizations can reuse existing governance processes and risk taxonomies while adding AI-specific controls (model integrity, data provenance, supply-chain of models, and robust monitoring of model drift). Practically, CISOs get a playbook for three urgent problems:

1. How to secure AI systems — protect training data, secure model weights, manage model access and updates.

2. How to use AI defensively — adopting AI for anomaly detection and automating incident triage, but with checks to prevent model exploitation.

3. How to prepare for AI-enabled attacks — adversaries using AI for automated spearphishing, synthetic voice, or automated vulnerability discovery.

NIST’s community approach (6,500 contributors in the profile’s development) signals two things: broad stakeholder investment and the likelihood that regulators and auditors will treat the profile as a de-facto standard. Organizations that adopt the profile’s recommendations early will have a head start in compliance and in designing operational guardrails for AI.

Actionable guidance

• Immediate: Subscribe to NIST’s comment process and run a gap assessment mapping current AI use cases to CSF 2.0 functions. Prioritize controls for model access management, training-data integrity, and logging.

• Short term: Implement provenance tooling—capture datasets, model versions, prompt logs, and human approvals—so you can audit model decisions.

• Medium term: Build an “AI Red Team” exercise into tabletop drills to simulate model poisoning, prompt-injection, and data exfiltration via model APIs.

Story 2 — Lessons from 2025: cybersecurity leaders’ top takeaways

What happened

CSO Online published a roundup of “top seven takeaways” from cybersecurity leaders for 2025 — a synthesis of what CISOs and security execs learned during a year dominated by supply-chain scrutiny, cloud rearchitecting, accelerated zero-trust adoptions, and pressure to operationalize threat intelligence. The piece distills practical lessons on resilience, governance, and technology priorities that should inform 2026 planning.

Source: CSO Online.

Why it matters (opinion)

What separates tactical noise from durable strategy is the lens of operationalization. The 2025 learnings show that mature teams didn’t just buy tools—they rewired processes: they automated response playbooks, raised telemetry coverage, and linked security metrics to business KPIs (MTTR, MTTD, dwell time). The implication is clear: next year will reward organizations that pair tooling with measurable process change and risk-based prioritization. Vendors that sell gold-plated capability but no implementation playbook will struggle to show ROI to security executives.

Actionable guidance

• For CISOs: Make the security operating model measurable—define KPIs tied to business outcomes, and prioritize projects with clear reductions in risk exposure.

• For vendors and integrators: Offer outcome-based engagements (e.g., reduce incident horizon by X days) and ship human playbooks with the product.

Story 3 — ServiceNow’s entry (via Armis): platform consolidation accelerates

What happened

ServiceNow’s acquisition of device-visibility leader Armis (reported and analyzed in industry press) is a strategic move: it buys deep IoT and asset intelligence to bolt into ServiceNow’s ITSM and SecOps surfaces. The transaction signals the company’s clear intent to be a one-stop workflow platform for enterprise security and operations. Industry analysts view the deal as ServiceNow moving beyond orchestration to owning raw telemetry and device context.

Source: Calcalistech (analysis of ServiceNow/Armis acquisition reporting).

Why it matters (opinion)

Platform owners buying telemetry specialists is a predictable but important cycle. Visibility is a prerequisite for automated response: orchestration without observability is an empty promise. ServiceNow’s move reduces friction for customers who want incident response to trigger concrete IT and security actions within a single system of record. For the market, expect two knock-on effects:

1. Bigger platforms will continue to acquire best-of-breed telemetry vendors, compressing the market for independent telemetry specialists.

2. SMB and mid-market customers will prefer bundled offerings—visibility + workflows—forcing smaller vendors to differentiate in verticals or integrate tightly with platform APIs.

Actionable guidance

• Security architects: Re-evaluate your visibility stack—prioritize device context, threat telemetry, and integration with your ITSM system to close the detection-to-remediation loop.

• Startups: If you’re a telemetry vendor, prepare acquisition-readiness: standardized APIs, clear commercial metrics (ARR by customer size, retention), and documented integration playbooks.

Story 4 — Predictions for 2026: identity, AI, and the collapse of perimeter thinking

What happened

SecurityWeek published a set of five predictions for 2026 arguing that identity will become the dominant security control, AI will both defend and attack at scale, and traditional perimeter defenses will erode as cloud, remote work, and zero-trust architectures become normative. The article urges CISOs to prioritize identity, continuous authentication, and model-aware defensive programs.

Source: SecurityWeek.

Why it matters (opinion)

Prediction pieces are useful when they accelerate decision making. The collapse of perimeter thinking is not only tactical rhetoric; it’s a strategic reorientation: organizations must assume presence across cloud providers, BYOD endpoints, and third-party ecosystems. The upshot:

• Identity is the new perimeter. Strong identity and access management (IAM), least privilege, continuous authentication, and credential posture management become first-class controls.

• AI reshapes both offense and defense. Defensive AI can reduce false positives and speed triage, but offensive AI will generate targeted, adaptive attacks (spearphish with personalized social engineering, automated vulnerability discovery).

• Perimeter collapse forces architecture changes. Expect more investment in data discovery, encryption-at-rest and in-transit, attribute-based access control (ABAC), and secure service meshes.

Actionable guidance

• Prioritize identity hygiene: remove legacy, orphaned privileges, adopt PAM for service accounts, and introduce step-up authentication for high-risk flows.

• Invest in defensive AI, but instrument for adversarial robustness: validate ML pipelines, adversarial-test detection models, and include human escalation points.

Story 5 — UAV Navigation & GN&C: cybersecurity as a system engineering requirement

What happened

Unmanned Systems Technology ran a feature on embedding cybersecurity into resilient UAV guidance, navigation and control (GN&C) systems. The article highlights how GN&C systems must resist spoofing, jamming, and software supply-chain compromise, and emphasizes that cybersecurity should be integral to the GN&C design — not retrofitted after the flight control logic is finalized.

Source: Unmanned Systems Technology.

Why it matters (opinion)

As drones and autonomous systems proliferate in commercial and defense sectors, the stakes rise: a compromised GN&C stack can produce physical harm, regulatory blowback, and cascading supply-chain risk. Embedding cybersecurity into the hardware/software co-design yields better assurances: secure boot, attested sensor fusion, redundant navigation sources, and encrypted command links. The broader lesson: cybersecurity must be treated as an engineering discipline fully integrated into product lifecycle, not an add-on compliance checkbox.

Actionable guidance

• Product teams building autonomous systems: require security architecture signoffs before hardware release. Adopt secure-by-design principles: hardware roots of trust, time-synchronized attestation, and fail-over GN&C strategies.

• Regulators & procurement: mandate demonstrable cybersecurity tests (penetration tests of GN&C, red-team exercises) for certification of unmanned platforms.

Cross-cutting themes — three strategic narratives

1. Identity-first security is no longer optional

Multiple threads — ServiceNow/Armis consolidation, SecurityWeek’s identity predictions, and CSO Online’s operational lessons — converge on one truth: identity and asset context are the new control plane. Organizations must make identity hygiene a continuous program (discover, revoke, monitor). Identity-first architectures reduce reliance on brittle network perimeters and help secure distributed cloud workloads and remote users.

2. AI is a double-edged sword: defensive capability + new threat surface

NIST’s Cyber AI Profile explicitly acknowledges that AI is both an enabler for defense and an attack vector. Defenders who embed AI responsibly (with provenance, logging, and human gates) will gain leverage; those who treat models as black boxes will incur systemic risk. Expect adversaries to weaponize AI for social engineering, noisy automation, and discovery at scale. Design for adversarial resilience.

3. Security must be engineered, not procured

The UAV GN&C coverage and enterprise platform moves show that security that is just ‘bolted on’ fails high-stakes contexts. Whether it’s unmanned aviation or model governance, the systems approach wins: security requirements baked into design, end-to-end testing, and lifecycle controls that include firmware, supply chain, and model updates.

Risks & warning signs to watch

• Regulatory fragmentation on AI security: NIST’s profile is foundational, but divergent frameworks (jurisdictional rules, sector guidance) will create complexity. Map and reconcile obligations early.

• False sense of security from AI tooling: Vendors will market AI-driven detection as silver bullets; operational discipline and validation remain necessary.

• Over-consolidation risk: Large platform rollups can create single points of failure—if a dominant provider’s telemetry or orchestration platform is compromised, the blast radius widens. Diversify critical detection and response dependencies where possible.

• Cyber-physical escalation: As GN&C systems proliferate, cyber incidents translate into physical harm and geopolitical escalation. Defense-grade testing standards should be adapted for civilian systems.

Practical playbook — what CISOs and leaders should do this quarter

For CISOs & security ops leads

1. Map AI usage and apply the Cyber AI Profile: inventory models, data flows, and external model dependencies. Run a gap analysis against NIST’s draft and prioritize remediation for model governance, access management, and logging.

2. Identity triage sprint: discover stale accounts and orphaned privileges, implement PAM for service and human accounts, and push MFA/step-up auth for critical roles.

3. Telemetry & playbook coupling: ensure device and asset telemetry feed your orchestration layer—whether ServiceNow or another platform—and automate low-risk remediation while reserving human judgment for high-impact events.

For product & engineering leaders

1. Secure-by-design mandate: require security signoffs on hardware (roots of trust) and software (SBOMs, signed updates), particularly for cyber-physical products like UAVs.

2. Model provenance and audit trails: store training data manifests, model hashes, prompt logs, and human approvals. Instrument for reproducibility.

For boards & executives

1. Demand outcome metrics: KPIs should include dwell time, % systems with continuous authentication, and % of production models with provenance records.

2. Scenario planning for AI-enabled attacks: tabletop exercises should include AI-augmented scenarios (automated phishing waves, model poisoning, supply-chain injection).

For investors & acquirers

1. Due diligence must include governance IP: prioritize startups that combine telemetry or model capability with auditable governance and documented implementation playbooks.

Longer view — how this reshapes vendor strategies and funding

• Vendor productization: vendors will package observability + remediation + advisory services. Expect consulting partnerships (tech + domain) to proliferate — similar to Penguin AI / FTI approaches in other sectors — because buyers pay premium for both tech and change management.

• Funding flows: investors will favor startups that either (a) solve identity, (b) provide auditable model governance, or (c) deliver verticalized security (OT, GN&C, healthcare). Pure-play point tools without clear integration or governance differentiation will face downward pressure.

• Consolidation vs. specialization paradox: platform owners will continue to acquire telemetry specialists, but specialization wins in high-assurance verticals. The smart path for startups is to be acquisition-ready while building vertical defensibility.

Conclusion — the pragmatic thesis

We’re living through a pivotal decade for security: AI and identity are changing the fundamentals of risk. NIST’s Cyber AI Profile is the industry’s cue to stop treating AI as a curiosity and to start treating it as a governance, engineering, and security priority. Platform consolidation (ServiceNow + Armis) and predictions for identity dominance confirm that visibility and access control are strategic assets. And the GN&C coverage is a brutal reminder: if security isn’t engineered into the product, it will be engineered into the failure.

In short: treat AI and identity as first-class citizens in your security program; instrument telemetry where it matters; and make security an integral part of engineering and procurement decisions. The organizations that act on these lessons now will reduce risk, move faster, and be far harder targets in 2026.

Sources

• Source: National Institute of Standards and Technology (NIST).
• Source: CSO Online.
• Source: Calcalistech (analysis of ServiceNow / Armis).
• Source: SecurityWeek.
• Source: Unmanned Systems Technology.