OWASP AIVSS is a scoring approach for measuring the security risk of AI systems and their components. It adapts vulnerability assessment concepts to AI-specific failures such as prompt injection, data poisoning, model abuse, unsafe tool use, and identity misuse across agentic workflows, helping teams prioritise remediation by severity and impact.
What OWASP AIVSS measures
OWASP AIVSS is a risk scoring method, not a vulnerability list. It gives teams a common way to express how severe an AI weakness is by combining likely impact, exploitability, and the operational consequences of failures in models, prompts, tools, and surrounding workflows.
That matters because AI systems fail in ways that are often harder to rank than traditional software bugs. A prompt injection, poisoned retrieval source, unsafe tool call, or manipulated output can be low-noise in isolation but high-severity when it affects decisions, automation, or connected systems.
How AIVSS fits AI security work
AIVSS is most useful when AI security reviews need prioritisation, not just description. It helps security, engineering, and governance teams compare very different AI failure modes on a shared scale so they can decide what to fix first, what to monitor, and what needs compensating controls.
The scoring approach also reflects a practical reality of AI applications: the same weakness can matter differently depending on exposure, autonomy, data sensitivity, and whether the system can act through tools or workflows. A score is only meaningful if the underlying system context is captured consistently.
For broader testing and control design, OWASP’s own verification guidance for application security remains a useful companion, especially where AI features are embedded in web or API layers. See the OWASP ASVS Guide for verification-oriented control thinking that often sits alongside AI risk scoring.
Why AI-specific scoring is different from traditional vulnerability scoring
Traditional scoring methods often assume a fairly direct software defect, such as injection, broken access control, or insecure configuration. AI systems add more ambiguous failure paths: model behavior can be probabilistic, prompts can be attacker-controlled, outputs can trigger downstream actions, and tool access can turn a text issue into a real operational event.
That is why an AI-focused scoring approach needs to account for misuse scenarios, propagation across chained components, and the trust a model has inside a workflow. The real concern is not only whether the model is “wrong”, but whether the wrongness can be steered, amplified, or operationalised.
For implementation context, the OWASP ASVS and the OWASP Top 10 help anchor AI risk discussions in established application-security patterns, especially when AI features are delivered through conventional software interfaces.
How practitioners should interpret an AIVSS score
An AIVSS score should be treated as a decision aid, not a final verdict. The number matters less than the assumptions behind it, especially the system boundary, threat model, user permissions, and whether the AI component can influence data, code, or actions outside its immediate prompt-response loop.
High scores typically indicate that a weakness can create fast escalation, broad blast radius, or difficult-to-detect misuse. Lower scores do not mean “safe”; they may simply reflect a narrower deployment context, limited privileges, or stronger compensating controls.
Because AI risk often crosses traditional control boundaries, teams usually get the best value from pairing scoring with security testing and maturity practices. The OWASP SAMM can help place AIVSS inside a broader secure development and assurance programme rather than using it as a one-off assessment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, OWASP SAMM and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V4 — API and Web Service | AI systems often expose model access and tool use through APIs, which AIVSS must score. |
| V6 — Authentication | AIVSS assigns severity to AI abuse paths that depend on weak or missing authentication. | |
| V8 — Authorization | AIVSS materially depends on whether AI actions and data access are properly authorized. | |
| Recommendation — Use V4 to verify request handling, authorization, and exposure around AI-facing APIs. Use V6 to harden authentication paths that gate access to AI features and tools. Use V8 to verify that AI components can only act within explicitly approved permissions. | ||
| OWASP SAMM | Security Requirements — Security Requirements | AIVSS supports risk-driven security requirements and prioritisation in the SDLC. |
| Recommendation — Embed AIVSS scoring into security requirements so AI risks are triaged during delivery. | ||
| NIST AI RMF | GOVERN — Govern | AIVSS supports AI risk governance by ranking system-level harms and control priorities. |
| Recommendation — Adopt GOVERN practices to assign ownership for AI risk scoring and remediation decisions. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org