A 6-Domain operating model for emerging AI security threats
21 named threats catalogued across both directions of the AI security threat model. The framework morphs by lens; threats can be selected to focus the view on a specific incident.
CSF Crosswalk
Map catalogued threats and controls to the CSF function you already report against. Function first.
Start here if the board or a regulator is your audience.
Open Crosswalk →Response Swimlane
See who acts, in what order, for a selected threat. Threat first, with delegation fallback for lean teams.
Start here if you run the team that responds.
Open Swimlane →Stack Lab
Evaluate what a capability stack changes across the six functions.
Start here if you are choosing or defending a security stack.
Open Stack Lab →Each lens morphs the diagram layout · Dimensions filter the threat population without changing the shape
Maintains a structured, evidence-based view of how AI can be used as an attack tool and how AI systems themselves can be attacked, using existing public taxonomies.
- 01AML.T0053 AI Agent Tool Invocation: abuse of agent toolset
- 02AML.T0086 Exfiltration via AI Agent Tool Invocation
- 03LLM01 Prompt Injection — primary GTG-1002 vector
- 04LLM06 Excessive Agency — most critical for agents
- 05ASI10 Rogue Agents — behavioural detection required