Imagine you are building a house. For decades, we've had a perfect set of blueprints and tools to measure how strong the walls are, how secure the locks are, and how likely a burglar is to pick a specific lock. These tools work great for standard houses made of wood and brick. But now, imagine we are suddenly building houses out of living, thinking clouds that can talk to you, write your emails, and even drive your car. The old tools don't work here. You can't measure the "strength" of a cloud with a hammer, and a burglar doesn't need to pick a lock; they just need to whisper a secret password to the cloud to make it let them in. This is the world of Artificial Intelligence (AI). It's a new kind of technology that learns from data instead of just following a fixed list of instructions. Because these AI systems are so new and so different, the old safety checklists we use for regular computer software are missing the most important parts of the puzzle. We need a new way to understand the risks, or we might find ourselves living in a house that looks safe but is actually full of invisible cracks.

This paper, written by Shubham Paikrao, is like a new, custom-made toolkit designed specifically for these "thinking cloud" houses. The author argues that the safety scores we use today are like trying to measure the weight of a cloud with a bathroom scale: they just don't fit. The paper suggests that instead of trying to force a new number onto old tools, we need to look at AI risk through five specific "lenses" or dimensions that current tools completely ignore. These lenses are: Attack Surface (how many doors and windows the AI has open), Model Exploitability (how easily the AI can be tricked or manipulated), Data Integrity (how trustworthy the information the AI learned from really is), Regulatory Exposure (how much trouble the AI could get the company in with the law), and Control Maturity (how good the company is at watching over the AI).

The paper doesn't claim to have a magic calculator that gives a perfect dollar amount for every risk right now. In fact, it explicitly says that we don't have enough history of AI disasters yet to make those precise financial predictions. Instead, it offers a "conceptual framework," which is a fancy way of saying it provides a sturdy scaffolding or a shared vocabulary. It's a way for bosses, security guards, and government regulators to all speak the same language when they talk about AI dangers. The author suggests that by using these five dimensions, organizations can stop guessing and start having clear, structured conversations about where their AI is weak and where they need to build stronger defenses. It's not a finished product, but it's the necessary first step to making sure our AI future doesn't collapse under its own weight.

The Problem with Old Safety Scores

Imagine you are a security guard at a museum. For years, you've used a special scanner to check paintings for cracks. If a painting has a crack, the scanner beeps and gives it a score from 1 to 10. This works perfectly for paintings. But then, the museum decides to display a robot that can paint its own pictures. The robot doesn't have cracks; it has "hallucinations" (where it sees things that aren't there), it can be tricked by a visitor whispering a weird phrase (called "prompt injection"), and it might slowly forget how to paint correctly over time (called "model drift").

If you try to use your old painting scanner on the robot, it will beep nothing. It will say the robot is perfectly safe because it can't find any cracks in the code. But the robot is actually in danger! The paper points out that our current safety tools, like the CVSS (which scores how bad a software bug is) and FAIR (which tries to guess how much money a disaster will cost), were built for the old world of static software. They are blind to the unique tricks that can break AI.

For example, the paper notes that CVSS is great at telling you how easy it is to break a door, but it has no way to measure how easily a robot can be tricked into opening the door because someone told it a funny joke. Similarly, FAIR is excellent at calculating financial risk, but it needs historical data (like "how many times did this happen last year?") to work. Since AI is so new, we don't have enough history of these specific AI disasters to feed the machine. The paper argues that trying to use these old tools for AI is like trying to measure the temperature of a fire with a ruler; the tool is just the wrong shape for the job.

The Five New Lenses

To fix this, the paper introduces five new ways to look at AI risk. Think of these as five different flashlights you need to shine on your AI system to see the whole picture.

1. Attack Surface: The Open Doors
This is about how many ways a bad actor can get in. For a normal computer, this might be a few open ports. For an AI, it's much bigger. Every time you talk to a chatbot, upload a file, or let the AI connect to your email, you are opening a new door. The paper highlights that if you let an AI agent (a robot that can do things) talk to your bank account or your email, you have a massive "attack surface." It's like leaving your front door, back door, garage, and basement windows wide open. The more ways the AI can interact with the outside world, the more exposed it is.

2. Model Exploitability: The Tricky Mind
This measures how easy it is to trick the AI. Some AIs are "black boxes" (we don't know how they think), while others are open. The paper suggests that if an AI's instructions are public or if the company is slow to fix known tricks, the AI is highly "exploitable." It's like a magician who has forgotten their secrets; if someone knows the trick, they can make the magician do anything. The paper notes that prompt injection (tricking the AI with text) is a fundamental part of how these models work, meaning it can't be completely "fixed" like a broken lock; it has to be constantly managed.

3. Data Integrity: The Poisoned Well
AI learns from data, just like a student learns from textbooks. If the textbooks are full of lies or poison, the student will learn lies. This dimension looks at three things:

• Poisoning: Did someone sneak bad data into the AI's training?
• Drift: Did the AI forget how to work because the real world changed? (Imagine a doctor AI that was trained on 2020 data trying to diagnose a 2026 virus; it might get it wrong).
• Hallucinations: Does the AI confidently make up facts?
  The paper emphasizes that unlike a broken computer program that just stops working, a "drifting" AI might keep working but give you subtly wrong answers for months without anyone noticing.

4. Regulatory Exposure: The Law's Watchful Eye
This is about the cost of breaking the rules. Governments are making new laws for AI, like the EU AI Act and rules from the SEC. If your AI breaks the law, you could face huge fines (up to 35 million euros or 7% of your global income, according to the paper) or have to disclose your mistakes to the public. The paper points out that old risk tools don't count these legal costs. It's like driving a car without insurance; the car might run fine, but if you crash, the financial hit is massive.

5. Control Maturity: The Security Guard's Skill
This is the final piece: how good is the company at managing the risks? Even if an AI has many open doors (high attack surface) and is easy to trick (high exploitability), the risk is lower if the company has a super-skillful security guard watching it 24/7. This includes things like testing the AI with bad inputs (red-teaming), monitoring its outputs, and having humans check important decisions. The paper argues that a company with a "mature" control system is in a much better position than one that just hopes for the best.

How It Works in the Real World

The paper uses three examples to show how this new framework changes how we think about risk.

• The Bank's Chatbot: This AI talks to customers and can look up account info. It has a High attack surface (everyone can talk to it) and High exploitability (it's a black box). It has Medium regulatory risk. The paper suggests this is a Critical risk because it's so easy to attack and so public.
• The Hospital's Triage AI: This AI helps doctors decide who needs help first. It has a Medium attack surface (only doctors use it) but High data integrity risk (if it hallucinates, a patient could get hurt). It also has Critical regulatory risk because of health laws. The paper says this is also Critical, but for different reasons. The fix isn't just "lock the door"; it's "make sure the AI isn't lying."
• The Software Company's Code Assistant: This AI helps programmers write code. It has a Low attack surface (only employees use it) and Low regulatory risk. Even if it makes mistakes, it's not a big deal. The paper says this risk is Managed and doesn't need as much attention.

The key takeaway is that two systems can both be "Critical" risks, but for totally different reasons. The old tools would just give them a single number, making it impossible to know how to fix them. This new framework tells you exactly where to focus your energy.

What the Paper Does and Does Not Do

It is important to understand what this paper is not claiming. The author is very clear that this is not a magic calculator that gives you a perfect dollar amount for risk right now. We don't have enough data yet to say, "This AI will cost us $50,000 if it fails." The paper admits that the numbers for how often these AI disasters happen are missing. Instead, the paper offers a structure for thinking. It's a way to organize the conversation so that when we do get the data in the future, we will know how to use it.

The paper also rules out the idea that we can just tweak the old tools. It argues that you cannot just add a few new settings to CVSS or FAIR to make them work for AI. The problem is deeper; the whole way we think about risk needs to change to include these new dimensions.

Why This Matters

The paper concludes that the biggest problem we face isn't that we don't know enough about the threats; it's that we don't have a shared language to talk about them. Regulators, insurance companies, and security teams are all speaking different languages. This framework proposes a common vocabulary. It gives a board of directors a way to understand the risk without needing to be a computer expert, and it gives security teams a clear checklist of what to build.

Ultimately, the paper suggests that we are in a "scaffolding" phase. We are building the structure that will eventually support a fully quantified, precise system of AI risk management. Until we have the data to fill in the numbers, this five-dimensional framework is the best tool we have to ensure we aren't building our future on a foundation of sand. It's a playful, practical, and necessary step toward making sure our AI friends don't accidentally burn the house down.