Resources/AIVSS Calculator

AIVSS Calculator

Traditional CVSS scoring was built for static software. Agentic AI systems act on their own, call tools, hold memory, and coordinate with other agents — capabilities that amplify the impact of an otherwise ordinary vulnerability. The OWASP AI Vulnerability Scoring System extends CVSS to capture that amplification. Select any of the ten OWASP Agentic AI Top 10 scenarios, score a finding, and download the full report.

AIVSS	AI Vulnerability Scoring System	The overall 0–10 score.
CVSS	Common Vulnerability Scoring System	FIRST.ORG standard; v4.0 supplies the base score.
AARS	Agentic AI Risk Score	Sum of the 10 agentic risk factors, 0–10.
AARF	Agentic AI Risk Factor	One factor, scored 0.0, 0.5, or 1.0.
ThM	Threat Multiplier	Adjusts for observed real-world exploitation.

Agentic (AARS) model

CVSS v4.0 base metrics combined with the 10 Agentic AI Risk Factors and an optional Threat Multiplier.

Industry model

The 9 AI-specific metrics across 39 sub-categories, weighted by seven industry profiles.

Private by design

Every calculation runs in your browser. No accounts, no uploads, no telemetry on your assessment data.

Pre-defined OWASP Scenarios

Select a scenario from the OWASP Agentic AI Top 10, then adjust it to your system.

Start from defaults and score your own finding.

CVSS v4.0 Base Metrics

The traditional vulnerability component of the score.

Exploitability

Attack Vector(AV)

Attack Complexity(AC)

Attack Requirements(AT)

Privileges Required(PR)

User Interaction(UI)

Vulnerable System Impact

Confidentiality(VC)

Integrity(VI)

Availability(VA)

Subsequent System Impact

Confidentiality(SC)

Integrity(SI)

Availability(SA)

Agentic AI Risk Factors (AARS)

Ten factors describing how much the agent's design amplifies risk. Each scores 0.0, 0.5, or 1.0.

Autonomy of Action(AU)

Degree to which the agent acts without human approval in the loop.

Tool Use(TU)

Ability to invoke external tools, APIs, code execution, or system commands.

Memory Use(MU)

Persistent memory across sessions that can be poisoned or exfiltrated.

Dynamic Identity(DI)

Agent assumes, delegates, or switches identities and credentials.

Multi-Agent Interactions(MA)

Communicates with or orchestrates other agents, expanding trust boundaries.

Non-Determinism(ND)

Identical inputs may yield different actions, complicating assurance.

Self-Modification(SM)

Can alter its own prompts, code, weights, or operating configuration.

Goal-Driven Planning(GP)

Decomposes objectives into multi-step plans it executes independently.

Contextual Awareness(CA)

Ingests broad external context, widening the untrusted-input surface.

Opacity and Reflexivity(OR)

Reasoning is opaque or self-referential, limiting auditability.

AARS subtotal0.0 / 10.0

Threat Multiplier (ThM)

Optional adjustment for observed real-world exploitation.

How the scoring works

Agentic (AARS) model

AIVSS = ((CVSS_Base + AARS) / 2) × ThM

The AARS component sums ten Agentic AI Risk Factors — autonomy, tool use, memory, dynamic identity, multi-agent interaction, non-determinism, self-modification, goal-driven planning, contextual awareness, and opacity — each scored 0.0, 0.5, or 1.0 for a total from 0.0 to 10.0. Averaging it with the CVSS v4.0 base score gives equal weight to what the vulnerability is and what the agent can do with it.

Industry model

AIVSS = [(w1×Base) + (w2×AI) + (w3×Impact)] × Temporal × Mitigation

Based on the OWASP Python calculator V4, this model scores 9 AI-specific metrics across 39 sub-categories and weights them by industry — financial services, healthcare, critical infrastructure, automotive, legal, government, or general.

Implementation notes. The CVSS v4.0 base score here is a calibrated approximation of the official MacroVector lookup table; the emitted vector string is spec-compliant, so you can paste it into the FIRST calculator for an authoritative figure. In the industry model, the nine AI metrics are aggregated by mean rather than by product — multiplying nine values each at or below 0.90 drives the result toward zero and would suppress the most heavily weighted term in the formula.

Pre-defined scenarios. The ten selectable scenarios map to the OWASP Agentic AI Top 10, AAI01 (Agentic AI Tool Misuse) through AAI10 (Agent Goal and Instruction Manipulation). Each ships a representative CVSS vector and agentic-factor profile for that risk class — a calibrated starting point for a typical instance, not a verdict. Adjust every metric to match the system you are actually assessing.

This calculator is an independent implementation offered for education and assessment guidance. It is not an official OWASP tool and does not constitute a formal certification. Always confirm results against the current AIVSS specification.