This opportunity space addresses the unique security challenges of AI models deployed at the edge, on IoT sensors, embedded devices, autonomous systems, and operational technology equipment within CNI environments. Edge AI can enable greater efficiencies and speed which can be vital to CNI business success and safety measures, however unlike centralised cloud-based AI, edge deployments often embed machine learning models directly into hardware with constrained resources, making them vulnerable to physical access, firmware exploitation, and model extraction attacks while operating in unpatched, resource-limited environments. The challenge is to ensure that AI models deployed on edge devices remain secure throughout their operational lifetime, can be effectively patched and monitored despite bandwidth and power constraints, and are protected against both remote and physical attacks. This is particularly critical for CNI applications where edge AI enables real-time decision-making in sensors, cameras, autonomous drones, industrial control systems, and distributed monitoring equipment.

What are the human-driven attack vectors?

In addition to misconfigurations, weak access controls and insider threats that expose models or data, unvetted deployment of pre-trained models that may carry trojans or malicious instructions could be exploited without sophisticated technical attacks. Human error in patching, updating, or monitoring edge devices also amplifies these vulnerabilities.

What could a proposed project scope look like?

This opportunity space focuses on establishing verifiable provenance for AI components; training datasets, pre-trained models, fine-tuning data, memory and inference APIs, used in CNI environments. The challenge is analogous to establishing a "chain of custody" for AI artifacts, ensuring that every component can be traced to its source, validated for integrity, and assessed for geopolitical or supply chain risks. The goal is to create standardised frameworks that enable CNI operators to answer: Where did this model come from? Who trained it? What data was used? Has it been modified?

What are the human-driven attack vectors?

Poisoned datasets (training and fine-tuning), pre-trained models with hidden backdoors, unauthorised access to memory during training or inference, and inside tampering and misuse of privileged access.

What could a proposed project scope look like?

This opportunity space addresses the challenge of ensuring that AI models remain trustworthy from development through deployment and in-life operational use within CNI environments. Unlike traditional software, AI models can degrade, drift, or be subtly manipulated in ways that evade conventional security controls. The challenge is to build verification pipelines that continuously validate model behaviour, detect integrity violations, and enforce security policies specific to safety-critical infrastructure.

The focus is on continuous verification, least-privilege access, and automated security checks throughout the AI delivery and operational pipeline; to include model testing, behavioural verification, and runtime integrity monitoring tailored to CNI operational requirements.

What are the human-driven attack vectors?

Attack vectors include backdoored or trojaned pre-trained models, malicious dependencies in composition frameworks, insider tampering, compromised update or deployment processes, and exploitation of weak access controls or verification gaps. Unintended or maliciously induced model drift can take place over time.

What could a proposed project scope look like?