A hands-on way to gauge AI ransomware risk

Most ransomware conversations still start with endpoints and email gateways. A new self-assessment tool asks security teams to look somewhere less familiar: the AI models, data pipelines and runtime environments their organizations are building on. The instrument, released for free online, is designed to help CISOs and engineers find where those AI systems might crack under a ransomware attack — before someone else finds it for them.

According to reporting by Infosecurity Magazine, the tool is called the Ransomware Assessment and Incident Defense Framework for AI Systems, or RAID-AI. It was developed over the past two years by Behnaz Karimi, co-lead of the Open Worldwide Application Security Project's (OWASP) AI Bill of Materials (AIBOM) initiative, with Yuvaraj Govindarajulu, also a co-lead at OWASP AIBOM.

RAID-AI is not a scanner. It is a structured questionnaire that asks security teams to grade their own controls, then shows them the gaps. The console is available at no cost and requires no connection to internal systems.

Why ransomware and AI models collide

Karimi told Infosecurity that RAID-AI addresses ransomware attacks against AI systems whether or not the attacker uses AI to carry them out. The distinction matters: the framework is about protecting AI assets, not about AI-powered attacks.

She pointed to two examples of the threat she says is emerging. One was an April 2025 report by Zoran Mitrovic, head of engineering at Kintra Health, which described ransomware actors using data poisoning techniques. The other was an alleged cyber-attack on Novo Nordisk in June 2026, in which hackers claimed to have stolen AI models used by the pharmaceutical company.

Those are the kinds of scenarios RAID-AI is meant to prepare for. AI systems sit on top of storage, APIs, training data and model artifacts — all of which can be encrypted, corrupted or held for ransom if the surrounding controls are weak.

How the assessment actually works

The framework is delivered through a web console aimed at CISOs, cybersecurity officers and security engineers. Users work through controls manually, selecting a maturity level for each on a scale from zero to five.

Controls are split into general and AI-specific categories, with levels labeled basic, advanced and high. General controls cover recovery, training and sensitive-data protection. AI-specific areas address data, tools and runtime.

Because the assessment is manual, organizations do not need to connect their internal systems or upload company documents. That lowers the barrier to starting, but it also shapes what the results mean: the tool does not independently verify an organization's security posture. Results depend entirely on how honestly and carefully users evaluate themselves.

Karimi suggested the work goes best when it is collaborative. The assessment is suited to workshops that bring together security managers, engineers and AI-security specialists, she told Infosecurity.

“Right now, we are slowly seeing that ransomware attacks targeting AI systems are happening,” Karimi said.

— Behnaz Karimi, co-lead of OWASP's AI Bill of Materials (AIBOM) initiative

The frameworks it plugs into

RAID-AI maps its controls to two voluntary security frameworks: the US National Institute of Standards and Technology's Cybersecurity Framework 2.0 (CSF 2.0) and the US Cybersecurity and Infrastructure Security Agency's Cybersecurity Performance Goals 2.0 (CPG 2.0).

It also allows users to map adversarial attacks through three attack-mapping frameworks: MITRE ATT&CK, MITRE ATLAS and NIST Adversarial.

That mapping is the practical heart of the tool. Organizations that already report against NIST or CISA goals can see how their AI-specific controls line up with work they are doing elsewhere, rather than treating AI security as a separate silo.

Inside the console and its output

The console displays results in dashboards, including maturity views and mappings to the other frameworks. Users can download PDF reports that highlight weaknesses and help teams set priorities.

Karimi described a two-tier use: the dashboard gives senior leaders a high-level overview, while technical teams use the underlying controls to guide more detailed discussions. Comprehensive documentation accompanies the tool, including guidelines for using it and an explanation of how it was developed and how maturity levels and security scores are calculated.

RAID-AI is described as fully available for anyone to use online for free.

An introduction that slipped off the schedule

Karimi and Govindarajulu had initially planned to introduce the framework at the ISC2 Security Congress, held in Denver, Colorado, between October 26 and 28. Visa issues kept Karimi from attending, so the launch moved online instead.

The framework's public availability now stands on its own, independent of the conference stage it was meant for.

What the numbers say

• Two years — the development period for RAID-AI, according to Infosecurity.
• Zero to five — the maturity scale users apply to each control.
• October 26 to 28 — the dates of the ISC2 Security Congress in Denver, Colorado, where the framework was originally to be introduced.
• April 2025 — the date of the report by Zoran Mitrovic on ransomware actors using data poisoning.
• June 2026 — the month of the alleged cyber-attack on Novo Nordisk in which hackers claimed to have stolen AI models.
• Two — the number of voluntary frameworks RAID-AI controls are mapped to: NIST CSF 2.0 and CISA CPG 2.0.

What comes next for the project

Karimi said she hopes to add practical implementation resources in the future, including videos and blueprints to help security engineers apply individual controls. She also wants to develop a similar tool for ransomware threats targeting agentic AI systems.

That second goal extends the framework's logic to a class of systems that act with less human oversight than a typical model deployment, though the details of how such a tool would work are not yet public.

The limits of a self-assessment

RAID-AI's manual design is both its strength and its constraint. A team can start without network access, procurement approval or a vendor contract. But the output is only as good as the answers entered into it, and the tool does not confirm that a control labeled advanced is actually operating that way.

For organizations that have never separately assessed AI infrastructure for ransomware exposure, the exercise may still surface gaps in recovery planning, sensitive-data protection and runtime monitoring that general security reviews overlook.

Why it matters for security teams

The framework arrives at a moment when AI systems are moving from experiments into production, often with security review trailing behind. A free, structured way to ask hard questions about model storage, training data and runtime environments gives defenders a starting point that does not depend on budget or vendor relationships.

That said, a self-graded maturity score is not an audit. Leaders who rely on the dashboard should treat it as a conversation starter rather than proof of resilience, and pair it with independent testing where the stakes are high. The more useful signal may be the act of assembling engineers, AI specialists and security managers in one room to argue about controls — which, as Karimi suggested, is how the assessment is meant to be used.