The AI Security Severity Index is a scoring method used to compare AI incidents by combining factors such as criticality, propagation, exploitability, supply chain exposure, and business impact. It gives practitioners a consistent way to rank incidents and prioritise response and remediation efforts.
Expanded Definition
The AI Security Severity Index is an incident-ranking method for AI and agentic systems that blends multiple risk dimensions into a single prioritisation score. In practice, it helps security teams compare events that are otherwise hard to order, such as prompt injection, model manipulation, credential abuse, data leakage, or supply chain compromise. The concept is still evolving across vendors and research groups, so no single standard governs this yet; organisations usually adapt the score to their own AI estate, tooling, and business exposure.
Unlike a simple vulnerability severity rating, this index should account for how an incident propagates through connected tools, whether an AI agent can execute actions, and whether exposed secrets or external integrations increase blast radius. That makes it especially useful in NHI-heavy environments where compromise of a token, API key, or service account can turn an AI issue into an operational incident. For a broader threat framing, see the CSA MAESTRO agentic AI threat modeling framework and NIST’s AI Risk Management Framework.
The most common misapplication is treating the index as a generic model-quality score, which occurs when teams ignore exploitability, credential exposure, and downstream business impact.
Examples and Use Cases
Implementing an AI Security Severity Index rigorously often introduces calibration overhead, requiring organisations to weigh fast triage against consistency across teams and incidents.
- A prompt injection in a customer-support agent scores higher when the agent can access ticketing, billing, and email tools, because propagation and business impact compound.
- A leaked API key used by an inference endpoint ranks above a low-impact model output error, because secret exposure creates immediate attacker access and faster abuse paths, as highlighted in the DeepSeek breach research.
- A model inversion issue affecting a public demo may score moderate if no sensitive NHIs, production data, or privileged integrations are present, but higher if the same model is wired to internal workflows.
- A third-party OAuth app connected to an AI workflow can raise the score substantially when the incident involves shared tokens or inadequate rotation, a pattern reflected in The State of Non-Human Identity Security.
- An exposed training corpus with embedded secrets can be ranked as a high-severity supply chain event, especially when the dataset is reused across multiple models or environments, as discussed in 12,000 Secrets Found in Public LLM Training Dataset.
For incident scoring practices, organisations can align to threat modeling patterns from the Anthropic Project Glasswing work when evaluating agent autonomy and tool use.
Why It Matters in NHI Security
In NHI security, severity is often driven less by the model itself and more by the identities and permissions attached to it. A low-confidence estimate can understate the consequences of a compromised service account, while an overblown score can bury urgent issues beneath noisy alerts. The index matters because it forces teams to compare incidents using the same operational language across secrets, agents, integrations, and exposed data paths.
NHIMG research shows how uneven the underlying controls remain: only 1.5 out of 10 organisations are highly confident in securing NHIs, and lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations. That means severity scoring is not just a reporting exercise; it helps distinguish a harmless AI defect from an incident that could trigger lateral movement, data exfiltration, or automated misuse of privileged tools. It also supports faster executive escalation when exposed NHIs are involved.
Organisations typically encounter the need for an AI Security Severity Index only after an AI incident has already spread through connected identities, at which point ranking and containment become operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Agent tool misuse and escalation are core factors in AI incident severity. |
| CSA MAESTRO | TM-1 | MAESTRO frames agentic AI threats through behavior, autonomy, and control exposure. |
| NIST AI RMF | The RMF supports risk prioritisation across harms, likelihood, and impact dimensions. | |
| NIST CSF 2.0 | RS.RP-1 | Response planning depends on consistent incident prioritisation and escalation. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust emphasizes limiting blast radius when identities or services are compromised. |
Use the index to rank incidents by agent autonomy, control paths, and potential impact.
