Will AI have its own cyber NATO? Nvidia launches the Open Secure AI Alliance (OSAA). This coalition brings together nearly 40 tech companies, with the primary goal of shaping the future standards for AI security.
Each founding member commits to provide either existing technologies or open-source projects, enabling them to place their building blocks at the very heart of the ecosystem.
Nvidia, for its part, offers open-source AI models accompanied by their trained weights, and also provides datasets along with the NOOA project. NOOA is a framework for controlling AI agents and is already available on GitHub.
HPE highlights its “open weight models” and its identity frameworks, aiming to secure the software development lifecycle. Meanwhile, CrowdStrike, Palo Alto Networks, and Cloudflare contribute their capabilities for detection and incident response.
OSAA aims to equip security teams with frontier, auditable, and sovereign tools. These resources will help audit, test, and control deployed autonomous agents.
Notable Absences and Market Fault Lines
OSAA enters a tense geopolitical and regulatory landscape. It presents itself as a security-nationally compatible alternative. The project relies on open technologies, yet remains controlled by allied Western companies.
As Nvidia sums it up, “The Open Secure AI Alliance will work to remediate vulnerabilities and disclose them using open technologies.” The alliance seeks to prioritize transparency… rather than blanket restrictions.
The initiative builds on existing communities such as the Linux Foundation, the Akrites initiative, and OpenSSF. It thus anchors itself in a well-structured open-source ecosystem.
Yet certain absences are highly telling. Meta signed a letter regarding the models but is not among the founders. Similarly, Google was listed in error before being removed from the roster.
These gaps clearly illustrate the fractures in the market:
Hyperscalers: Microsoft is present, but Google and AWS are absent, signaling divergent strategic approaches.
Radical open source vs. controlled openness: Players like Hugging Face coexist with defense specialists (Palantir, SpaceX). This mix could fuel tensions over how open the standards truly are.
Geography: The alliance brings together American, European, and Korean companies. It forms a predominantly Atlantic bloc, with no representation from China or the Global South.
Who will capture the value of AI security?
In the medium term, OSAA could structure several emerging segments:
AI security platforms: Integrated solutions to protect models, pipelines, and agents.
LLM security: Services for auditing and stress-testing models.
AI governance: Tools for traceability and compliance (AI Act, NIST, etc.).
Traditional cybersecurity vendors want to extend their reach. CrowdStrike, Palo Alto Networks, and Cloudflare aspire to become the cross-cutting security layer for AI.
Meanwhile, infrastructure providers like Nvidia, HPE, and Dell seek to embed security natively, hoping to strengthen the perceived value of their platforms.
For specialized startups (Hugging Face, LangChain, Nous Research), the challenge is twofold: they must gain legitimacy without turning their technologies into mere commodities.
Like the CNCF for cloud-native computing, OSAA aims to standardize security practices. In the near term, the coalition will publish reference architectures for governments.
Later, it will seek to influence international standards and data sovereignty.
Behind this collaborative effort lies a classic contest for influence. The player who imposes its frameworks will lock in practices and capture the majority of the value.
