New Framework Bolsters Ransomware Defenses for AI Systems

“Right now, we are slowly seeing that ransomware attacks targeting AI systems are happening,” Behnaz Karimi told Infosecurity.

RAID-AI: a hands-on ransomware readiness assessment for AI systems

A new, freely available online tool — the Ransomware Assessment and Incident Defense Framework for AI Systems (RAID-AI) — gives security teams a structured way to identify weaknesses that could let ransomware disrupt or steal AI assets. RAID-AI was developed over two years by Behnaz Karimi and Yuvaraj Govindarajulu, co-leads of the Open Worldwide Application Security Project’s (OWASP) AI Bill of Materials (AIBOM) initiative, and the authors planned to introduce it at the ISC2 Security Congress in Denver, October 26–28, although Karimi was unable to attend because of visa issues.

Control categories: recovery, training, sensitive-data protection; data, tools and runtime

The RAID-AI assessment groups controls into general cybersecurity measures and AI-specific areas. General controls include recovery, training and sensitive-data protection; AI-specific controls cover data, tools and runtime. Users select maturity levels for each control on a zero-to-five scale, labeled in the console with tiers such as basic, advanced and high. The framework is designed to surface gaps across both traditional IT hygiene and the peculiar risks that AI models and their supporting infrastructure introduce.

Assessment model and limits: manual, workshop-focused, not an automated audit

RAID-AI operates through a web console but is deliberately manual. Teams do not connect internal systems or upload company documents to the tool; instead they assess their own controls and enter maturity scores. That design choice means RAID-AI does not independently verify an organization’s posture — results depend on users’ evaluations — and Karimi recommends running the assessment as a workshop that brings security managers, engineers and AI-security specialists together. The console produces dashboards for high-level maturity views, mappings to other frameworks, and downloadable PDF reports intended to help leaders prioritize follow-up work while giving technical teams the controls needed for deeper remediation conversations.

Mapping to NIST CSF 2.0, CISA CPG 2.0 and adversarial frameworks

RAID-AI maps its controls to two voluntary U.S. frameworks — the National Institute of Standards and Technology’s Cybersecurity Framework 2.0 (NIST CSF 2.0) and the Cybersecurity and Infrastructure Security Agency’s Cybersecurity Performance Goals 2.0 (CISA CPG 2.0). It also allows users to map adversarial activity to three adversary-mapping frameworks: MITRE ATT&CK, MITRE ATLAS and NIST Adversarial. Karimi and Govindarajulu published comprehensive documentation that explains how the tool was developed and how maturity levels and security scores are calculated, and the console displays those mappings in its dashboards.

Threat evidence cited: April 2025 data poisoning report and June 2026 alleged model theft

Karimi pointed to concrete incidents to frame RAID-AI’s urgency. She highlighted an April 2025 report by Zoran Mitrovic, head of engineering at Kintra Health, which detailed how ransomware actors used data poisoning techniques. She also cited an alleged June 2026 cyber-attack on Novo Nordisk in which hackers claimed to have stolen AI models used by the pharmaceutical company. Those examples underscore the framework’s dual focus on traditional ransomware outcomes and AI-specific harms such as model compromise and training-data tampering.

What this means for CISOs, cybersecurity officers, and security engineers

• CISOs and senior leaders can use RAID-AI’s dashboard and downloadable PDF reports to gain a high-level view of AI-related ransomware resilience and to set priorities for investment and oversight.
• Cybersecurity officers will find the framework’s mappings to NIST CSF 2.0 and CISA CPG 2.0 useful for aligning AI resilience work with existing governance and reporting frameworks.
• Security engineers and AI-security specialists can use the framework’s underlying controls and planned implementation materials to guide technical remediation, particularly around data hygiene, tool provenance and runtime protections.

Future plans: blueprints, videos and agentic AI assessments

Karimi said the team intends to expand RAID-AI beyond assessment. Planned additions include practical implementation resources — videos and blueprints to help engineers apply individual controls — and a similar assessment designed for ransomware threats targeting agentic AI systems. For now, RAID-AI’s value lies in a disciplined, workshop-based process that translates observed AI-targeted ransomware activity into concrete control checks and prioritised remediation steps.

Original story: Infosecurity — New Framework Puts Ransomware Resilience for AI Systems in Focus