A CVSS score describes a flaw in software, but it says nothing about whether that software is an autonomous agent holding production credentials, so two findings with the same CVSS score can carry very different real risk. The OWASP AI Vulnerability Scoring System (AIVSS) addresses this by keeping CVSS v4.0 as the technical baseline and adding an agentic uplift based on what the affected system can do. This guide explains how AIVSS v0.8 is built, its ten agentic core risks and ten amplification factors, how to fold it into an existing vulnerability triage process, and where it fits beside CVSS, SSVC and the AI risk frameworks. It is written for vulnerability management leads, product security teams and AI platform owners. Facts were checked against aivss.owasp.org and the v0.8 publication on 8 November 2026; AIVSS is still pre-1.0, so details may change.
Key takeaways
- CVSS v4.0 stays as the floor. AIVSS takes the CVSS v4.0 score as the technical severity baseline and adds risk for agentic capabilities; the publication tells practitioners not to feed it CVSS v3.1 scores.
- Ten amplification factors drive the uplift. Autonomy, Tools, Language, Context, Non-Determinism, Opacity, Persistence, Identity, Multi-Agent and Self-Modification, each scored 0.0, 0.5 or 1.0 to produce the Agentic AI Risk Score (AARS).
- Prioritise on the AIVSS result, not CVSS. The publication says remediation order should follow the final AIVSS ranking, and that scores in the same severity band should be treated as equivalent.
- Identity is both a factor and a risk. Agent Identity Impersonation and Agent Access Control Violation are two of the ten core risks, so non-human identity controls directly lower agentic scores.
- It is a moving target. The OWASP AIVSS site lists v0.8 as the latest version; the project lead's announcement (March 2026) says v1.0 is expected before the end of 2026. Record the AIVSS version beside every score.
What it is and who it applies to
AIVSS is an OWASP project that describes itself as a standardised framework for assessing and quantifying security risks in AI systems. It begins with a scoring system for the OWASP Agentic AI Core Security Risks and is intended to grow into a broader framework for all AI systems. The current publication is "AIVSS Scoring System For OWASP Agentic AI Core Security Risks v0.8"; v0.5 is archived. The project leads listed on the site are Ken Huang, Michael Bargury, Vineeth Sai Narajala, Bhavya Gupta and Tim Marple.
According to the v0.8 announcement, the team incorporated more than 1,900 public comments after v0.5 and added an updated quantitative model for agentic risk amplification, revised core risks and attack scenarios, mappings to the OWASP Top 10 for Agentic Applications for 2026, CSA MAESTRO and AIUC-1, tighter alignment with the NIST AI Risk Management Framework, and an appendix of expert survey findings. The announcement gave 16 April 2026 as the opening of a public review period ahead of v1.0.
AIVSS is useful to three groups:
- Vulnerability management teams that already score with CVSS and need a defensible way to rank findings in agent and LLM systems.
- Product security and red teams reporting findings in AI products, who need a severity that reflects agent reach.
- Risk and governance functions that want AI findings expressed in terms that link to the NIST AI RMF and agent certification schemes.
It does not replace CVE assignment, CVSS or exploit-likelihood data. See the CVSS v4 Guide and the EPSS Guide.
Structure and key requirements
The baseline: CVSS v4.0
AIVSS v0.8 requires a CVSS v4.0 score as its input because v3.1 and v4.0 metrics are not directly comparable. CVSS v4.0 assesses impact separately for the Vulnerable System (VC, VI, VA) and for Subsequent Systems (SC, SI, SA), and FIRST notes that the old Scope metric is retired. The AIVSS publication points practitioners to the Subsequent System metrics for impact on connected agents, orchestrators and SaaS integrations, and asks assessors to consider everything a compromised agent can reach. That instruction alone changes many scores: an injection flaw in a chatbot with no tools has little subsequent impact, while the same flaw in an agent with write access to a CRM has a great deal.
The uplift: Agentic AI Risk Score
The AARS is built from ten amplification factors, scored with a rubric in the publication (Table 2) at 0.0 (none), 0.5 (partial) or 1.0 (full). The publication describes the approach in words as technical severity from CVSS forming the baseline risk floor, with an agentic uplift applied based on the system's capabilities; the AARS equation and the final combination are set out in section 3.3 of the v0.8 PDF. Use the official calculator rather than re-implementing the maths, and confirm against the current publication because the model has changed between versions.
| Factor (v0.8 order) | Question to ask during scoring (our phrasing) | Evidence to collect |
|---|---|---|
| Autonomy | How far can the system act without per-action human approval? | Approval gates, action policies |
| Tools | What tools, APIs and systems can it call? | Tool registry, MCP server list, scopes |
| Language | Does it take natural language instructions that can carry attacker input? | Input sources, retrieval sources |
| Context | How much context and data does it draw on at runtime? | Retrieval and memory configuration |
| Non-Determinism | Can the same input produce different actions? | Model settings, test variance |
| Opacity | Can you see why it took an action? | Reasoning and tool call logs |
| Persistence | Does it keep memory or state between sessions? | Memory stores, retention settings |
| Identity | How does it authenticate and whose authority does it act with? | Agent identity record, credential type and lifetime, delegation model |
| Multi-Agent | Does it delegate to or accept work from other agents? | Orchestration topology, agent-to-agent trust |
| Self-Modification | Can it change its own code, prompts, tools or configuration? | Change controls on agent configuration |
The middle column is NHI Mgmt Group's plain-language prompt for each factor, not the AIVSS rubric text. Score against the rubric in the publication.
The ten agentic core risks
v0.8 scores findings against ten Agentic AI Core Security Risks. Mapping each finding to one of them gives reports a shared vocabulary.
| AIVSS core risk | Further reading on nhimg.org (for orientation) |
|---|---|
| Agentic AI Tool Misuse | See the OWASP Agentic Top 10 ASI02 Guide |
| Agent Access Control Violation | See the OWASP Agentic Top 10 ASI03 Guide |
| Agent Cascading Failures | See the OWASP Agentic Top 10 ASI08 Guide |
| Agent Orchestration and Multi-Agent Exploitation | See the OWASP Agentic Top 10 ASI07 Guide |
| Agent Identity Impersonation | See the OWASP Agentic Top 10 ASI03 Guide |
| Agent Memory and Context Manipulation | See the OWASP Agentic Top 10 ASI06 Guide |
| Insecure Agent Critical Systems Interaction | See the AI Agent Action Approvals and Spending Limits Guide |
| Agent Supply Chain and Dependency Risk | See the OWASP Agentic Top 10 ASI04 Guide |
| Agent Untraceability | See the AI Agent Audit Trails for Regulators Guide |
| Agent Goal and Instruction Manipulation | See the OWASP Agentic Top 10 ASI01 Guide |
The right-hand column is our orientation aid for further reading, not the official AIVSS mapping. v0.8 includes its own mapping to the Agentic Top 10 for 2026; use that for formal reporting.
Calculators
The site lists an AIVSS 1.0 reference calculator as live, and a Python reference calculator (V4) in the project repository with seven industry profiles (General, Financial, Healthcare, Critical Infrastructure, Automotive, Legal, Government), 39 sub-questions across nine AI-specific metrics, and Base, Temporal and Environmental metrics with mitigation multipliers. The calculators and the v0.8 publication use different metric structures, so record which tool and version produced each score and do not mix scores from different tools in one ranking.
Identity and NHI requirements
Identity appears in AIVSS three times: as the Identity amplification factor, and in two core risks. The v0.8 publication lists these risk scenarios:
- Agent Identity Impersonation: agent impersonation, human impersonation, compromised agent identity verification, misleading agent cards and capability claims, shared identity pools, and traceability and attribution gaps.
- Agent Access Control Violation: forged role assertions, shadow identity bridging, and the absence of cryptographic role attestation.
- Agent Untraceability: actions that cannot be attributed to an agent and the human it acted for.
Practically, the identity controls that lower an agent's exposure under these headings are the same ones that work for any non-human identity: a unique identity per agent (never a shared pool), short-lived and narrowly scoped credentials, delegation that records the human principal, signed or attested agent metadata, and logs that bind each tool call to both. Because CVSS Subsequent System impact depends on what the agent can reach, tightening its permissions reduces the score through the baseline as well. See the Agent Identity and Access Guide, the AI Agent Authorisation Guide and the AI Agent Credential Lifecycle and Rotation Guide.
Implementation steps
This is NHI Mgmt Group's recommended rollout for adding AIVSS to an existing vulnerability process.
- Move AI findings to CVSS v4.0. If your scanners or bug bounty platform still emit v3.1, rescore AI-system findings in v4.0 first, including Subsequent System metrics. AIVSS will not give meaningful results on v3.1 inputs.
- Build an agent capability profile. For each agent or AI application, record the evidence in the factor table above once. Most factors describe the system, not the flaw, so the profile is reused for every finding in that system.
- Score in shadow mode. For one quarter, compute AIVSS alongside your current priority without changing SLAs. Compare where rankings diverge and review those cases with the system owner.
- Agree the decision rule. Decide which AIVSS bands map to which remediation SLAs, and how AIVSS combines with exploit likelihood and asset criticality. Many teams will feed it into an SSVC decision rather than use it alone. See the SSVC Guide.
- Switch on and record versions. Make AIVSS the ranking for AI-system findings, store the AIVSS version, calculator and factor scores in the ticket, and keep the CVSS v4.0 vector beside it.
- Use findings to drive controls. When a high factor (for example Tools or Identity at 1.0) drives many high scores, fix the capability, not just the bug: reducing tool scope lowers every future score for that agent.
- Roll back if needed. If AIVSS rankings prove unstable after a version change, revert to CVSS-plus-context ranking for the affected systems while you rescore. Keeping both values in the ticket makes this a configuration change, not a rework.
Choosing how much to adopt
| Situation | Suggested approach (ours) |
|---|---|
| Few AI systems, mostly third-party chat assistants without tools | Keep CVSS v4.0 with Subsequent System metrics; record AIVSS factors only for any agent with tools |
| Several internal agents with tool or data access | Shadow-score with AIVSS, then adopt for AI findings with an SSVC decision on top |
| AI product vendor reporting findings to customers | Publish CVSS v4.0 and AIVSS together with version and factor scores, so customers can apply their own environment |
| Agents in regulated or safety-relevant processes | Adopt AIVSS, link high-band findings to control requirements via the AIUC-1 crosswalk or your control catalogue |
Evidence and assessment
An AIVSS score is only as defensible as its inputs. For each scored finding keep:
- The CVSS v4.0 vector, including SC, SI and SA with a note of which connected systems were considered.
- The ten factor scores, the rubric reason for each, and the date of the capability profile.
- The AIVSS version (for example v0.8) and the calculator used.
- The core risk the finding maps to, and the remediation decision with its owner.
Metrics to show the process is working (our suggestions):
- Percentage of AI-system findings with a complete AIVSS record.
- Mean time to remediate by AIVSS band, compared with the agreed SLA.
- Number of agents whose capability profile was reviewed in the last 90 days.
- Count of findings where AIVSS changed priority compared with CVSS, and the review outcome.
- Reduction in average factor score for Tools and Identity across the agent estate.
Mapping to other frameworks
| Framework | Relationship to AIVSS |
|---|---|
| CVSS v4.0 (FIRST) | Required baseline input; AIVSS adds agentic uplift |
| SSVC | Decision model that can consume AIVSS as one input; the AIVSS team also described a separate qualitative SSVC decision-tree draft as a working document |
| OWASP Top 10 for Agentic Applications for 2026 | v0.8 adds a mapping from the core risks |
| NIST AI RMF | v0.8 states alignment with Govern, Map, Measure and Manage. See the NIST AI RMF Guide |
| CSA MAESTRO | Used alongside AIVSS as a threat modelling reference architecture |
| AIUC-1 | Interactive crosswalk published 27 February 2026 links core risks to AIUC-1 requirements. See the AIUC-1 Agent Certification Guide |
| NIST SP 800-53 Rev. 5 and CSF 2.0 | AIVSS supports RA-5 Vulnerability Monitoring and Scanning and RA-3 Risk Assessment; CSF ID.RA-01, ID.RA-05 and ID.RA-08 |
| MITRE ATLAS | Use techniques such as AML.T0051 LLM Prompt Injection and AML.T0053 AI Agent Tool Invocation to describe the attack behind a finding |
Common pitfalls
- Feeding in CVSS v3.1. The publication warns against it. Rescore in v4.0 first.
- Scoring Subsequent System impact as none. Teams copy the scanner vector, which ignores what the agent can reach. Assess connected systems explicitly.
- Re-scoring factors per finding. Factors describe the system. Profile once, review on change, and reuse, or scores will vary by analyst.
- Treating decimals as precision. The publication says scores within the same band are equivalent for prioritisation. Do not rank 7.2 above 7.1.
- Mixing calculator outputs. The web calculator, the Python V4 calculator and the v0.8 publication use different structures. One version per ranking.
- Fixing the bug and leaving the capability. If Tools and Identity are at 1.0, the next finding will score high too. Reduce scope and move to task-bound credentials.
Practitioner checklist
- Rescore AI-system findings in CVSS v4.0, including SC, SI and SA metrics.
- Build a capability profile per agent covering all ten amplification factors, with evidence.
- Map every AI finding to one of the ten AIVSS core risks.
- Run AIVSS in shadow mode for a quarter before changing SLAs.
- Combine AIVSS with exploit likelihood and asset criticality in one documented decision rule.
- Store AIVSS version, calculator, factor scores and CVSS vector in every ticket.
- Give each agent a unique identity and task-scoped, short-lived credentials to lower Identity and access risk.
- Review capability profiles when an agent gains tools, memory or delegation.
- Track the move to AIVSS v1.0 and plan a rescoring window.
Standards and references
- OWASP: AI Vulnerability Scoring System (AIVSS)
- OWASP: AIVSS Scoring System for OWASP Agentic AI Core Security Risks v0.8
- OWASP: AIVSS project repository and reference calculator
- OWASP: AIUC-1 and AIVSS Crosswalk
- OWASP AIVSS project lead: v0.8 release announcement (secondary, personal blog)
- FIRST: Common Vulnerability Scoring System v4.0
Related NHI Mgmt Group resources: CVSS v4 Guide · SSVC Guide · OWASP AI Exchange Guide · Risk-Based Vulnerability Management Guide