This initiative kicks off with the critical development of a ** scoring system specifically for the Agentic AI Core Risks. This initial, high-impact deliverable will then expand into a comprehensive **Artificial Intelligence Vulnerability Scoring System (AIVSS) Framework Package. The broader project aims to provide a structured and quantifiable methodology to identify, assess, and mitigate vulnerabilities specific to all types of AI systems – not just Large Language Models (LLMs), Generative AI, or Agentic AI. The ultimate goal is a complete AIVSS Framework Package that serves as a baseline for understanding and managing AI security risks across the entire AI landscape.

Key Deliverables

1. AIVSS Scoring System For OWASP Agentic AI Core Security Risks
   • A quantifiable scoring methodology tailored to the unique risks identified in the OWASP Agentic AI Core Risks.
   • Rubrics and guidelines for assessing the severity and exploitability of these specific vulnerabilities.
2. Comprehensive AIVSS Framework Package:
   • Standardized AIVSS Framework: A scalable framework validated across a diverse range of AI applications, including and extending beyond Agentic AI.
   • AIVSS Framework Guide: Detailed documentation explaining the metrics, scoring methodology, and application of the framework.
   • AIVSS Scoring Calculator: An open-source tool to automate and standardize the vulnerability scoring process.
   • AIVSS Assessment Report Templates: Standardized templates for documenting AI vulnerability assessments.

🚀 Get Involved: Sign Up as a Contributor

We welcome your expertise and enthusiasm!
To join the OWASP AIVSS project as a contributor, simply add your information to our public signup sheet and submit a pull request.

How to sign up:

1. Open the contributors signup sheet using Google Doc with your information added
2. Add your details as a new row in the table (see the example provided).

Example entry is provided in the signup sheet to help you get started.

We welcome contributors of all backgrounds and experience levels—OWASP membership is not required. If you’re new to GitHub or open source, feel free to ask for help—everyone is welcome!

Road Map

The following is the initial roadmap:

1. AIVSS Scoring System For OWASP Agentic AI Core Security Risks(Months 1-3):
   • Define core AIVSS metrics, with an initial focus on metrics directly applicable to scoring the OWASP Agentic AI Core Risks. Ensure clarity and precision.
   • Develop initial scoring rubrics for these Agentic AI-focused metrics.
2. AIVSS Framework Specialization & Expansion (Months 4-6):
   • Develop specialized scoring rubrics for other specific AI system types (beyond Agentic AI).
   • Identify factors unique to each AI type that influence vulnerability assessment.
   • Create templates for AIVSS assessment reports, adaptable to different AI system types.
3. AIVSS Scoring Calculator Development (Months 7-9):
   • Develop the core functionality of the AIVSS scoring calculator, ensuring it supports core AIVSS metrics, and specialized rubrics.
   • Implement the ability to add new AIVSS metrics and scoring rubrics.
4. AIVSS Tool Testing and Refinement (Months 10-12):
   • Test the AIVSS scoring calculator against a diverse set of AI systems (including Agentic AI test cases), generating assessment reports.
   • Refine metrics, rubrics, and the calculator based on user feedback and assessment results.
5. Documentation and Release (Month 12):
   • Finalize the AIVSS Framework Guide (comprehensive, clear, easy to understand).
   • Release the AIVSS Scoring Calculator as an open-source project.
   • Publish AIVSS assessment report templates and example reports (including for Agentic AI) on the OWASP project website.
   • Create detailed project documentation, including an integration guide for existing SDLCs.

Multi-Year Project Roadmap

• Year 2: Apply AIVSS to Financial and Healthcare Industries:
  • Develop industry-specific guidelines for applying AIVSS to AI systems in finance and healthcare.
  • Create case studies and assessment reports showcasing AIVSS application in these sectors.
  • Collaborate with industry experts for validation and alignment with best practices.
• Year 2/3: Expand AIVSS for Emerging AI Threats:
  • Continuously update the AIVSS framework to address new AI security threats, including further evolutions in Agentic AI vulnerabilities beyond the initial core risks.
  • Develop new AIVSS metrics and scoring rubrics as needed.
• Year 3+: AIVSS Certification Program:
  • Explore creating a certification program for professionals proficient in using the AIVSS framework to drive adoption and enhance AI security expertise.