# Quantifying Security Vulnerabilities: A Metric-Driven Security Analysis of Gaps in Current AI Standards

arXiv: https://arxiv.org/abs/2502.08610 · HTML: https://mlsanity.com/paper/2502.08610/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 66 references that are in the map.
- First posted on arXiv 12 Feb 2025.

## Builds on (most cited first, 3 of 3)

- [Frontier AI Regulation: Managing Emerging Risks to Public Safety](https://mlsanity.com/paper/2307.03718/) (2023)
- [Towards Concrete and Connected AI Risk Assessment (C2AIRA): A Systematic Mapping Study](https://mlsanity.com/paper/2301.11616/) (2023)
- [A Rapid Review of Responsible AI frameworks: How to guide the development of ethical AI](https://mlsanity.com/paper/2306.05003/) (2023)

## Abstract (arXiv)

As AI systems integrate into critical infrastructure, security gaps in AI compliance frameworks demand urgent attention. This paper audits and quantifies security risks in three major AI governance standards: NIST AI RMF 1.0, UK's AI and Data Protection Risk Toolkit, and the EU's ALTAI. Using a novel risk assessment methodology, we develop four key metrics: Risk Severity Index (RSI), Attack Potential Index (AVPI), Compliance-Security Gap Percentage (CSGP), and Root Cause Vulnerability Score (RCVS). Our analysis identifies 136 concerns across the frameworks, exposing significant gaps. NIST fails to address 69.23 percent of identified risks, ALTAI has the highest attack vector vulnerability (AVPI = 0.51) and the ICO Toolkit has the largest compliance-security gap, with 80.00 percent of high-risk concerns remaining unresolved. Root cause analysis highlights under-defined processes (ALTAI RCVS = 033) and weak implementation guidance (NIST and ICO RCVS = 0.25) as critical weaknesses. These findings emphasize the need for stronger, enforceable security controls in AI compliance. We offer targeted recommendations to enhance security posture and bridge the gap between compliance and real-world AI risks.