Paper: arXiv 2511.21901

Authors: Hernan Huwyler

Abstract

The accelerating deployment of artificial intelligence systems across regulated sectors has exposed critical fragmentation in risk assessment methodologies. A significant “language barrier” currently separates technical security teams, who focus on algorithmic vulnerabilities (e.g., MITRE ATLAS), from legal and compliance professionals, who address regulatory mandates (e.g., EU AI Act, NIST AI RMF). This disciplinary disconnect prevents the accurate translation of technical vulnerabilities into financial liability, leaving practitioners unable to answer fundamental economic questions regarding contingency reserves, control return-on-investment, and insurance exposure. To bridge this gap, this research presents the AI System Threat Vector Taxonomy, a structured ontology designed explicitly for Quantitative Risk Assessment (QRA). The framework categorizes AI-specific risks into nine critical domains: Misuse, Poisoning, Privacy, Adversarial, Biases, Unreliable Outputs, Drift, Supply Chain, and IP Threat, integrating 53 operationally defined sub-threats. Uniquely, each domain maps technical vectors directly to business loss categories (Confidentiality, Integrity, Availability, Legal, Reputation), enabling the translation of abstract threats into measurable financial impact. The taxonomy is empirically validated through an analysis of 133 documented AI incidents from 2025 (achieving 100% classification coverage) and reconciled against the main AI risk frameworks. Furthermore, it is explicitly aligned with ISO/IEC 42001 controls and NIST AI RMF functions to facilitate auditability.

Complexity vs Empirical Score

  • Math Complexity: 2.5/10
  • Empirical Rigor: 6.0/10
  • Quadrant: Street Traders — practical and empirical, lighter on theory

Why this score: The paper presents a comprehensive, structured taxonomy mapping technical AI threats to business loss categories for quantitative risk assessment, supported by an empirical analysis of 133 real-world AI incidents. While mathematical formulations are light and focused on conceptual Monte Carlo inputs rather than complex proofs, the framework bridges critical operational and regulatory gaps clearly and systematically.

Research Flowchart

  flowchart TD
    A["Research Goal: Bridge gap between technical AI threats,<br/>regulatory compliance, and quantitative financial risk"] --> B["Data Inputs: Analyzed 133 documented<br/>AI incidents from 2025"]
    
    B --> C["Taxonomy Development: Categorized risks into 9 domains<br/>and 53 sub-threats for Quantitative Risk Assessment (QRA)"]
    
    C --> D["Cross-Domain Mapping: Linked technical threat vectors<br/>to business loss types (CIA, Legal, Reputation)"]
    
    D --> E["Framework Reconciliation: Mapped controls to<br/>ISO/IEC 42001, NIST AI RMF, and MITRE ATLAS"]
    
    E --> F["Key Outcome: Achieved 100% classification coverage and<br/>enabled financial/operational risk quantification"]