Last December, the International Telecommunication Union (ITU), the United Nations’ (UN) body for information and communication technologies, supported Open Cybersecurity Schema Framework (OCSF) for ratification as an international standard by June 2026. Standardization is now a global necessity as governments worldwide integrate ITU standards into their national cybersecurity policies.
First, What is OCSF?
The OCSF provides a standardized approach to streamline security operations, improve threat detection, and accelerate incident response. This unlocks the full potential of security data. A standardized schema for security events normalizes data from various sources, which creates a unified foundation for advanced analytics and AI-powered tools. This standardization is crucial for unleashing the full potential of generative AI in cybersecurity, allowing organizations to better identify patterns and correlations across disparate data sources.
Data Standardization is Crucial
Security is fundamentally a data problem. Modern enterprises generate security logs across on-premises data centers, cloud environments, and SaaS applications. This wealth of information should accelerate detection and response, but inconsistent log formats create friction. When each security tool uses a different schema, engineers spend time building data pipelines and custom parsers instead of developing advanced detection algorithms. This slows investigations and hampers the ability to leverage AI-powered security operations.
Standardized schemas enable AI systems to correlate events across sources, identify patterns, and generate accurate insights. This gives models consistent, unambiguous data to reason effectively. OCSF provides that foundation: an open source standard that automatically normalizes security data from any source into a common language, creating AI-ready data without custom parsers or complex pipelines.
OCSF Turns Data into Agentic Security Operations
The key to this transformation was OCSF’s standardized schema, which enabled efficient queries that weren’t possible before. Security investigations previously required learning different log formats, developing complex queries for each data source, and manually decoding output into meaningful information. With OCSF, an orchestrator coordinates child agents that automatically retrieve relevant runbooks, pull business context, analyze logs without format translation, and generate actionable insights. The AI doesn’t misinterpret data because OCSF provides consistent attribute definitions, unambiguous data types, and standardized query paths across all log sources.
OCSF provides a universal format that removes hours of manually stitching logs from different services together. Beyond improving data quality, OCSF gives AI systems the consistent language they need to reason effectively. This shifted security operations from reactive analysis to intelligent, automated response. The future of security isn’t about hiring more analysts. It’s about empowering the analysts you have with AI systems that understand their environment.
From Emerging Standard to 1.8.0
The OCSF community continues to evolve the framework to meet emerging security challenges, while maintaining strict backwards compatibility. Since the last update at Black Hat 2025, the community has released v1.8.0 (released March 16th, 2026), with enhancements focused on AI operation observability, network packet-level visibility, and privilege analysis.
Key enhancements in v1.8.0 include:
- AI Operation Support: A new ai_operation profile and supporting objects (ai_model, message_context) bring native schema coverage for AI workloads, including token usage metrics and role-based interaction tracking.
- Privilege Analysis with ATT&CK Mapping: New objects (privilege_info, privilege_attack_info, service_privilege_analysis) enable detailed privilege analysis with MITRE ATT&CK technique mapping, supporting unused privilege detection and access risk assessment.
- macOS Extension and Cross-Platform Improvements: A new macOS extension adds egid and euid to the process object, with related attributes promoted from the Linux extension to the base schema for cross-platform reuse.
- Network Packet Capture: A new packet object on network event classes enables packet-level data representation, along with a network_observation_point attribute for richer traffic context.
These enhancements reinforce OCSF’s role as the schema for AI-ready security operations, extending native coverage to the AI workloads and network telemetry that modern detection and response demands.
Getting Security AI-Ready
The security industry is entering a new era where AI-powered security operations become the norm rather than the exception. Agentic AI scales the traditional SOC model, where analysts manually triage alerts, investigate incidents, and respond to threats, to meet the velocity and complexity of modern attacks.
Standardizing security data allows organizations to build the foundation for autonomous threat hunting and investigation, predictive vulnerability analysis, and intelligent response orchestration.
As governments worldwide incorporate ITU standards into national cybersecurity frameworks, regulated industries, like they have with other standards, will lead OCSF adoption.
Additionally, OCSF maintainers have initiated collaboration with OpenTelemetry (OTEL) maintainers to integrate security and observability domains. Unifying security telemetry with operational telemetry enables holistic analysis: understanding what happened, why it happened, and what it means for the broader system.
This new landscape brings parity to adopters. AI is transforming security operations, and OCSF is how organizations future proof security data for this transformation.