💻 computer science

ISVEX: A method for the assessment of the risk exposure of intelligent systems

This paper introduces ISVEX, a comprehensive vulnerability scoring method featuring both "Strong" and "Lite" variants designed to address the specific limitations of existing standards by quantifying unique AI risks such as model manipulation, data poisoning, and agentic vulnerabilities through a tailored multi-metric framework.

Original authors: Eduardo Arriols-Núñez, Mary Luz Mouronte-López

Published 2026-07-06

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Eduardo Arriols-Núñez, Mary Luz Mouronte-López

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to rate how dangerous a new type of car is. For decades, we've used a standard checklist (called CVSS) to rate regular cars. That checklist asks: "Can a thief break the window? Can they hotwire the engine? If they steal the car, how much damage is done?"

But today, we have Self-Driving Cars (Intelligent Systems). These aren't just metal boxes; they can talk to other cars, change their own software, make decisions on their own, and even trick their sensors with stickers on stop signs. The old checklist doesn't work here because it doesn't know how to measure a car that can "hallucinate" a green light or a robot that can hack its own brakes.

This paper introduces ISVEX, a new, specialized "danger meter" designed specifically for these smart, autonomous systems.

The Problem: The Old Ruler Doesn't Fit

The authors argue that the current tools for rating risk are like trying to measure a cloud with a ruler.

CVSS (The Old Standard): Great for regular software, but it treats a chatbot the same as a self-driving car. It misses things like "prompt injection" (tricking the AI with words) or "data poisoning" (feeding the AI bad information to make it learn wrong lessons).
AIVSS (The Newer Attempt): This was a first step to fix CVSS for AI, but the authors say it's like a "half-measure." It averages the scores, which often dilutes the danger. If a system has a tiny flaw but a massive, catastrophic potential, the average score makes it look "medium risk" when it should be "critical."

The Solution: ISVEX (The AI Danger Meter)

ISVEX is a scoring system that gives a number from 0 to 10 to represent how risky an AI system is. It comes in two flavors:

1. The "Strong" Version (The Full Exam)

This is a deep dive, like a full medical checkup. It uses 38 different questions grouped into 7 categories.

The Basics: It still checks the old stuff (can someone hack the network?).
The AI Core: It asks, "Can someone trick the AI's brain?" (Prompt injection) or "Can they steal the AI's secrets?"
The Agent Layer: This is the new part. It asks, "Can this AI talk to other AIs and give them bad orders?" or "Can it change its own code?" It treats the connection between robots (protocols like MCP and A2A) as a critical security zone.
The Context: It asks, "How many people are affected?" and "Can we undo the damage?" (If an AI spreads a fake video of a CEO, that damage is permanent. If a regular website goes down, you can just restart it).

The "Anti-Dilution" Trick:
The paper highlights a clever math trick. In the old systems, if you had one "Critical" flaw and nine "Low" flaws, the average would make the whole thing look "Medium." ISVEX says: "Nope." If one part is critical, the whole system gets a high warning, even if the rest is safe. It also has "floors" (minimums) to ensure that if a system controls something dangerous (like a hospital robot), it can't get a low score just because it's hard to hack.

2. The "Lite" Version (The Triage)

Imagine a security guard at a busy airport. They don't have time for a full medical exam on every passenger. They need a quick scan.

ISVEX Lite uses only 12 key questions.
It takes about 3 minutes to run.
It's designed for emergency teams (SOCs) to quickly decide: "Is this a minor glitch, or do we need to call the whole team?"
If the Lite score is high, they switch to the "Strong" version for a full investigation.

How It Works in Real Life (The Scenarios)

The authors tested their new meter against 10 different "what-if" scenarios to prove it works better than the old ones. Here are a few examples:

The "Trick Sign" (Adversarial Attack): Someone puts a sticker on a stop sign that looks normal to humans but tells a self-driving car it's a speed limit sign.
- Old Meter: Says "Medium Risk."
- ISVEX: Says "Critical (10/10)" because lives are at stake and the damage is irreversible.
The "Fake CEO" (Deepfakes): Criminals use AI to make a fake video of a CEO ordering a bank transfer.
- Old Meter: Says "Medium Risk" (just a data leak).
- ISVEX: Says "High Risk" because the damage to reputation is permanent and affects the whole company.
The "Boring Glitch" (Internal DoS): A disgruntled employee crashes a small internal chatbot used by 50 people for 2 hours.
- Old Meter: Says "Medium Risk" (it's a standard outage).
- ISVEX: Says "Low Risk (1.3/10)" because it only affected 50 people and was easily fixed. The old meter was too scary here; ISVEX calms it down.

The Connection to "Red Teaming"

The paper also explains how to actually find these risks. It suggests using AI Red Teaming.

Think of Red Teaming as hiring a group of "ethical hackers" to try to break your AI.
ISVEX acts as the scorecard for these hackers. Instead of just saying "We broke it," the Red Team uses ISVEX to say, "We broke it with a score of 8.5 because we tricked the AI into revealing secrets."
This turns vague complaints into hard numbers that security teams can use to prioritize fixes.

The Bottom Line

The paper claims that ISVEX is a necessary upgrade. It argues that we can no longer use the same safety ruler for a toaster that we use for a self-driving robot. By adding specific questions about AI behavior, agent communication, and the real-world consequences of failure, ISVEX provides a more accurate, fair, and actionable way to measure risk in the age of intelligent machines.

Technical Summary: ISVEX – A Method for the Assessment of the Risk Exposure of Intelligent Systems

1. Problem Statement

Artificial Intelligence (AI) systems, ranging from Large Language Models (LLMs) to autonomous agents and multi-agent architectures, have transitioned from research prototypes to production environments. However, existing vulnerability assessment standards, specifically CVSS v4.0 and OWASP AIVSS v0.5, lack the specific metrics required to quantify risks inherent to these systems.

The paper identifies several critical gaps in current standards:

Missing AI-Specific Vectors: They fail to address model manipulation (prompt injection, jailbreaking), data poisoning, adversarial attacks, and model theft.
Lack of Autonomy Differentiation: They treat passive chatbots and autonomous agents (which can execute code, invoke APIs, and make decisions) identically, ignoring "agentic amplification" where an agent escalates privileges through multiple tools.
Protocol Blindness: They do not account for vulnerabilities in inter-agent communication protocols like MCP (Model Context Protocol) and A2A (Agent-to-Agent).
Granularity and Context: They fail to differentiate the scale of affectation (e.g., 50 users vs. 50 million), ignore the reversibility of damage, and lack metrics for attack detectability and cascading impacts across interconnected systems.
Calculation Flaws: AIVSS v0.5 uses a simple mean formula that dilutes critical scores when one component is low, and it lacks impact floors to ensure safety-critical systems receive appropriate severity ratings.

2. Methodology: ISVEX

The authors propose ISVEX (Intelligent System Vulnerability Exposure Index), a vulnerability scoring method designed to capture the full spectrum of AI risks. The method is offered in two alternatives: Strong (comprehensive) and Lite (rapid triage).

2.1 The Strong Alternative

The Strong version utilizes 38 metrics organized into 7 groups and an 8-step calculation pipeline.

Metric Groups:

Base – Exploitability (5 metrics): Inherited from CVSS v4.0 (Attack Vector, Complexity, Requirements, Privileges, User Interaction).
Base – Impact (6 metrics): Inherited from CVSS v4.0 (Confidentiality, Integrity, Availability for both vulnerable and subsequent systems).
AI-Core (6 metrics): Specific to the model, including Model Behavior Evasion (MBE), Data Pipeline Integrity (DPI), Explainability Risk, Autonomy Level, Model Theft, and Trust Boundary Violation.
Agentic & Protocol (8 metrics): Specific to autonomous agents and protocols, covering Tool & Channel Integrity (TCX), Multi-Agent Interaction, Self-Modification, Goal-Driven Planning, Memory Persistence, Dynamic Identity, Secure Comm. Protocol, and Non-Determinism. These use a 5-level scale (N/L/M/H/C).
AI-Extended (3 metrics): Training Data Quality, Detectability, and Cascading Impact.
Environmental (6 metrics): Organizational context, including Confidentiality/Integrity/Availability requirements, AI System Criticality (ASC), Exploit Maturity, and Mitigation Controls.
Contextual Modifiers (4 metrics): Scale of Affectation, Reversibility, Governance/Societal impact, and Attack Operationalization.

Calculation Pipeline:

Exploitability & Impact: Calculated using CVSS v4.0 formulas.
AI Score: Computed as a weighted sum of AI-Core and Agentic & Protocol metrics. A critical innovation is the 85% floor rule: the final AI score cannot fall below 85% of the highest individual metric, preventing critical vulnerabilities from being diluted by low-risk metrics.
Combined Score: Uses a max-weighted formula ( $0.6 \times \text{max} + 0.4 \times \text{mean}$ ) to combine Base, AI, and Environmental scores. This avoids the dilution effect of simple averages while retaining contextual information.
Amplification: Multipliers are applied for criticality (up to $\times 2.0$ for safety-critical systems), stealth attacks, and cascading impacts.
Graduated Impact Floors: A set of rules (R1–R5) and bonuses (B1–B7) ensures that specific high-risk combinations (e.g., safety-critical systems with integrity compromise) receive a minimum score (e.g., 8.0), regardless of low exploitability.
Final Score: Contextual multipliers (Scale, Reversibility, Governance, Operationalization) are applied, capped at 10.0.

2.2 The Lite Alternative

Designed for Security Operations Centers (SOC) and incident response teams, ISVEX Lite reduces the assessment to 12 high-discriminatory metrics (selected from the Strong version). It uses a simplified formula to produce a score in approximately three minutes. Validation shows it deviates by $\pm 0.8$ points from the full version in 80% of cases, though it may underestimate risk in complex multi-agent scenarios.

3. Key Contributions

The paper claims the following primary contributions:

Comprehensive Metric Architecture: A 38-metric framework covering traditional IT risks, AI-specific model risks, and the emerging "Agentic & Protocol" layer (MCP/A2A).
Novel Calculation Logic:
- A max-weighted combination (60/40 split) to prevent score dilution.
- Graduated Impact Floors to guarantee minimum severity for safety-critical scenarios.
- Contextual Multipliers to scale scores based on user impact, reversibility, and regulatory context.
Operational Integration: A formal protocol linking ISVEX metrics to AI Red Teaming frameworks (HarmBench, garak, AutoRedTeamer, AART, MITRE ATLAS), allowing Red Team findings to directly populate metric values.
Dual-Mode Utility: A "Lite" version for rapid triage and a "Strong" version for exhaustive analysis.

4. Results and Validation

The method was validated against 10 hypothetical scenarios covering a risk spectrum from 0 to 10, including prompt injection, adversarial attacks on autonomous driving, supply chain backdoors, multi-agent privilege escalation, and data poisoning.

Comparative Findings:

vs. AIVSS v0.5: In 9 of 10 scenarios, ISVEX scored higher than AIVSS, with a mean increase of +2.3 points in high-risk scenarios. The largest delta was +3.4 points in a multi-agent privilege escalation scenario, attributed to ISVEX's specific protocol metrics and impact floors.
vs. CVSS v4.0: CVSS consistently underestimated AI-specific risks, often rating them as "Medium" when ISVEX rated them "High" or "Critical." Conversely, in a low-impact scenario (DoS on an internal chatbot with 50 users), ISVEX scored 2.7 points lower than CVSS, demonstrating its ability to scale down risk when context (reversibility, small scale) justifies it.
Precision: The method successfully differentiated between scenarios that previous standards treated identically (e.g., distinguishing a passive chatbot leak from an autonomous agent escalation).

5. Significance and Claims

The authors position ISVEX as a necessary evolution in vulnerability management for the era of autonomous AI. The paper claims that:

Current standards are insufficient: CVSS and AIVSS lack the granularity and specific metrics to quantify the unique risks of model manipulation, agent autonomy, and protocol-level attacks.
ISVEX bridges the gap: By incorporating specific metrics for agentic behavior and communication protocols, and by using a calculation pipeline that prevents critical risks from being diluted, ISVEX provides a more accurate reflection of real-world AI risk.
Operational Relevance: The method is designed to be actionable, linking directly to Red Teaming outputs and existing security workflows (SIEM, ticketing), and offering a rapid triage option for time-constrained environments.

The paper concludes that ISVEX offers a more precise, scalable, and context-aware approach to risk assessment, capable of handling the full spectrum of modern AI threats from low-impact internal tools to safety-critical autonomous systems.