AI security isn't a sub-discipline of information security. The threat model is genuinely different:

• The asset isn't data; it's behavior. Traditional information security protects data assets: confidentiality, integrity, availability. AI security has to additionally protect AI behavior, asking does the model do what it's supposed to do, can it be manipulated to do otherwise, can it leak training data through inference patterns the underlying data classification didn't catch.

• The threats are model-specific. Prompt injection, training-data poisoning, model extraction, jailbreaks, agentic goal hijack, deepfake misuse are threats that don't map cleanly onto the existing control library. The OWASP Agentic Top 10 and OWASP LLM Top 10 establish AI-specific taxonomies; the existing security stack mostly doesn't speak them.

• The vendor surface is exploding. Every SaaS vendor is shipping AI features. The existing TPRM playbook assumes vendors disclose what they're doing; AI vendor questionnaires often aren't read carefully because they don't fit the questions the security reviewer is trained to ask.

• The accountability chain is new. When a model behaves unexpectedly in production, who owns it? The vendor who built the model, the integrator who deployed it, the business team that approved it, the security function that signed off the assessment? Most enterprises haven't resolved this, so the boundary is still being drawn.