AI Vulnerability Intelligence Navigator

AI Vulnerability Intelligence Navigator: What It Is and How to Use It.

The Security of AI™ AI Vulnerability Intelligence Navigator is an interactive decision-support tool designed to help users understand vulnerabilities, weaknesses, attack techniques, and risk conditions that can affect artificial intelligence systems.

Traditional cybersecurity vulnerability databases are extremely valuable, but AI systems introduce additional security concerns involving models, training data, AI agents, applications, infrastructure, supply chains, and autonomous behavior.

The AI Vulnerability Intelligence Navigator brings these different perspectives together in one place.

It correlates AI security information across recognized cybersecurity and AI security sources, including:

• CVE / NVD — publicly disclosed software vulnerabilities and vulnerability information
• MITRE CWE — underlying software and system weakness classifications
• CISA Known Exploited      Vulnerabilities (KEV) — vulnerabilities known to have been exploited in the wild
• MITRE ATLAS™ — adversarial tactics and techniques targeting AI-enabled systems
• NIST AI 100-2 — adversarial machine learning attack taxonomy and terminology
• OWASP — application, LLM, Generative AI, and agentic AI security risks
• OWASP AIVSS — emerging AI vulnerability scoring methodology

The objective is not to replace these authoritative sources.

The Navigator provides a Security of AI™ correlation and interpretation layer that helps answer a different question:

What does this vulnerability or weakness mean for an AI system?

Why It Matters

AI vulnerabilities do not always look like traditional software vulnerabilities.

A conventional cybersecurity vulnerability may involve a specific flaw in a particular product or software version. AI systems can also be exposed through weaknesses involving training data, models, prompts, retrieval systems, agents, tools, APIs, memory, permissions, supply chains, and autonomous actions.

Some AI security problems have CVE identifiers.

Others may be better described as weaknesses, adversarial techniques, AI risk conditions, or amplification factors.

Understanding AI vulnerability therefore requires looking beyond any single database or framework.

The AI Vulnerability Intelligence Navigator helps connect these different sources so users can better understand:

Where is the weakness?

How could it be exploited?

How serious could it become in an AI system?

What other vulnerabilities or attack techniques are related?

What can be done to reduce the risk?

How to Use the AI Vulnerability Intelligence Navigator

Step 1 — Explore the Vulnerability Map

Select a vulnerability or weakness from the interactive map.

Entries are organized across AI security domains including:

• Model
• Data
• Application
• Agent
• Infrastructure
• Governance
• Agentic Amplification

You can also use the search and filtering controls to narrow the displayed vulnerabilities.

Step 2 — Select an Entry

Select any vulnerability, weakness, attack technique, risk condition, or amplification factor to open its detailed intelligence panel.

The TYPE field helps distinguish what you are examining.

An entry may represent a:

• Vulnerability
• Weakness
• Attack Technique
• Risk Condition
• Amplification Factor

This distinction is important because an adversarial technique is not necessarily the same thing as a software vulnerability.

Step 3 — Understand the Security Significance

Each entry provides a plain-language description explaining why the issue matters to an AI-enabled system.

An Example Attack Scenario demonstrates how the vulnerability or weakness could appear in a realistic AI environment.

These scenarios are provided to help users understand potential attack paths and consequences. Unless specifically identified as a documented incident, they should be considered illustrative examples.

Step 4 — Review Severity and AI Amplification

The Navigator provides several perspectives for understanding potential severity.

SOAI Technical Severity Estimate

Provides a class-level Security of AI™ assessment of the potential technical severity of the issue.

Actual CVSS scores apply to specific vulnerabilities and may differ depending on the affected product, version, configuration, and vulnerability.

SOAI AI Amplification Estimate

Examines how AI characteristics such as autonomy, external tool access, persistent memory, nondeterministic behavior, data access, or agent-to-agent interaction could amplify the security consequences.

SOAI Organizational Risk

Provides a Security of AI™ risk perspective using likelihood and impact to help users consider the vulnerability within a broader organizational or mission context.

These assessments are intended to support analysis and prioritization. They do not replace authoritative vulnerability scores or organization-specific risk assessments.

Step 5 — Examine Authoritative Framework Mappings

Where applicable, the Navigator correlates the selected entry with recognized cybersecurity and AI security sources.

These may include:

CVE / NVD

Specific publicly disclosed vulnerabilities associated with the issue.

MITRE CWE

Underlying software or system weaknesses that may contribute to the vulnerability.

CISA KEV

Identification of specific associated CVEs that should be checked against the CISA Known Exploited Vulnerabilities Catalog.

MITRE ATLAS™

Adversarial AI techniques that may exploit or relate to the weakness.

NIST AI 100-2

Relevant adversarial machine learning attack classifications.

OWASP

Relevant LLM, Generative AI, application, or agentic AI security risks.

Authoritative identifiers are linked to their source whenever available so users can examine and verify the underlying information.

Step 6 — Review Recommended Mitigations

Each entry provides recommended actions that may help reduce the identified risk.

Mitigations may include controls involving:

• Access control
• Input validation
• Data integrity
• Model protection
• Agent permissions
• Tool restrictions
• Monitoring and logging
• Supply-chain security
• Human approval
• Red-team testing
• Continuous assurance

Mitigation recommendations should always be evaluated within the architecture, mission, operating environment, and risk tolerance of the specific AI system.

Step 7 — Explore Related Vulnerabilities

AI vulnerabilities rarely exist in isolation.

The Navigator identifies related vulnerabilities, weaknesses, and attack conditions that may form part of a larger attack path.

Following these relationships can help reveal how an attacker might move from one weakness to another.

For example:

Prompt Injection → Excessive Agency → Unauthorized Tool Execution → Data Exfiltration

Understanding these relationships helps move vulnerability analysis from isolated findings toward AI system-level threat analysis.

Connecting the Security of AI™ Navigators

The AI Vulnerability Intelligence Navigator is part of the growing Security of AI™ intelligence toolset.

Each Navigator answers a different security question.

AI Risk Intelligence Navigator

What can go wrong with AI?

Explore AI risks, likelihood, impact, mitigations, and framework relationships.

MITRE ATLAS Intelligence Navigator

How can an adversary attack an AI system?

Explore adversarial AI tactics, techniques, scenarios, mitigations, and attack-chain relationships.

AI Vulnerability Intelligence Navigator

Where are the exploitable weaknesses?

Explore vulnerabilities, weaknesses, attack techniques, AI amplification, authoritative mappings, and mitigations.

Together, these tools help connect:

Risk → Threat → Vulnerability → Mitigation → Defense

Future Security of AI™ assurance capabilities will extend this relationship toward testing, evidence, residual risk, and verification of whether the defenses actually work.

Who Should Use This Tool?

The AI Vulnerability Intelligence Navigator is designed for anyone who wants to better understand AI security, including:

• Cybersecurity professionals
• AI and machine learning engineers
• AI red teams
• System engineers
• Risk managers
• AI governance professionals
• Acquisition professionals
• Security architects
• Researchers
• Students
• Executives and decision-makers

You do not need to be an AI security expert to use the Navigator.

Start with a vulnerability that interests you, explore the explanation and relationships, and follow the authoritative sources when you want to go deeper.

Start Exploring

Select Launch AI Vulnerability Intelligence Navigator to begin.

Choose a vulnerability from the map, search for a topic, or filter the vulnerabilities by domain.

No registration required.

Important Notice

The Security of AI™ AI Vulnerability Intelligence Navigator is an independent educational and decision-support resource.

It is not affiliated with, sponsored by, or endorsed by MITRE, NIST, CISA, OWASP, or other referenced organizations.

CVE, CWE, CISA KEV, MITRE ATLAS™, NIST publications, OWASP resources, and other referenced frameworks remain authoritative at their respective official sources.

Framework mappings, class-level severity estimates, AI amplification estimates, attack scenarios, mitigation guidance, and SOAI risk assessments represent Security of AI™ analysis unless explicitly identified as values or information obtained from an authoritative source.

Users remain responsible for verifying vulnerability status and evaluating security information within their specific system architecture, operational environment, mission, and risk context.