RAID-AI: The Manual Framework Measuring Ransomware Resilience of AI Systems

OWASP AIBOM co-leads Behnaz Karimi and Yuvaraj Govindarajulu released RAID-AI, a free web-based framework for manually assessing AI system ransomware resilience, mapping controls to NIST CSF 2.0 and MITRE ATLAS as AI-targeted attacks emerge.

On October 30, 2026, Behnaz Karimi and Yuvaraj Govindarajulu, both co-leads of the OWASP AI Bill of Materials (AIBOM) initiative, publicly released the Ransomware Assessment and Incident Defense Framework for AI Systems (RAID-AI). The tool arrives as ransomware already incorporates artificial intelligence into its attack chains, with offensive frameworks like Phantom having struck dozens of organizations. RAID-AI promises no automation: it is a web console that guides teams through a manual assessment of their controls, with maturity levels from 0 to 5 and mappings to industry standards and adversarial attack frameworks.

Key Takeaways

RAID-AI is a free, manual assessment framework accessible via web console, developed by two OWASP AIBOM co-leads over roughly two years.
Controls are structured into general measures (recovery, training, sensitive data protection) and AI-ecosystem-specific controls (data, tools, runtime).
The framework maps controls to NIST CSF 2.0 and CISA CPG 2.0, and adversarial attacks to MITRE ATT&CK, MITRE ATLAS, and NIST Adversarial.
It requires no connection to internal systems or upload of corporate documents, enabling adoption even in environments with compliance constraints.

An Arms Race Where the Attack Accelerates

The release timing is not coincidental. According to the source, Karimi cited an April 2025 report by Zoran Mitrovic (Kintra Health) on data poisoning techniques adopted by ransomware operators, and an alleged attack on Novo Nordisk in June 2026 involving theft of AI models. In the broader context, the Phantom framework — discovered by SOCRadar and documented by The Hacker News on October 23, 2026 — has hit approximately 62 organizations with AI-executed intrusions approved by human operators, according to multiple secondary sources.

This tension is the core of the problem: attackers are already using AI to scale infrastructure, while defenses remain largely manual and self-assessed. RAID-AI explicitly acknowledges this gap: the framework "does not independently verify an organization's security posture," as the source notes. The validity of the output depends on the truthfulness of the teams' self-assessments.

The Framework Structure: General and AI-Specific

RAID-AI organizes controls in two dimensions. The first covers general cybersecurity measures: recovery, staff training, sensitive data protection. The second is dedicated to the AI ecosystem and includes three areas: data, tools, and runtime. Each control is manually assessed on a maturity scale from 0 to 5, with levels qualified as basic, advanced, and high.

The output translates into dashboards and PDF reports, with "various security scores" that the source does not detail further. The framework then integrates controls with existing standards — NIST CSF 2.0 and CISA CPG 2.0 — and allows mapping of adversarial attacks through three frameworks: MITRE ATT&CK (for traditional cybersecurity), MITRE ATLAS (dedicated to AI threats), and NIST Adversarial. This dual mapping serves as a bridge between established compliance and emerging AI-specific risks.

The Limitation of Manual in an Automated World

RAID-AI's architectural choice is explicitly offline and manual: no connection to internal systems, no upload of corporate documents. This lowers the adoption barrier in environments with compliance restrictions, but introduces an obvious constraint. The framework's maturity depends on the competence and honesty of the teams filling it out, without automatic validation or third-party audit mentioned by the source.

"Right now, we are slowly seeing that ransomware attacks targeting AI systems are happening" — Behnaz Karimi, co-lead OWASP AIBOM

Karimi indicated the ideal use of the framework in workshops bringing together "security managers, engineers and AI-security specialists." This approach reflects an awareness: assessing ransomware resilience in AI systems requires hybrid skills that rarely converge in a single figure or team.

What to Do Now

For teams managing AI systems, adopting RAID-AI requires three concrete steps. First, organize an internal workshop with security managers, engineers, and AI-security specialists, replicating the modality indicated by Karimi. Second, assess the AI-ecosystem-specific controls — data, tools, runtime — before the general ones, since the latter are already covered by established frameworks. Third, use the mapping to MITRE ATLAS to identify which AI-specific adversarial tactics apply to your context, integrating them into existing incident response plans.

For compliance officers, RAID-AI offers an immediate bridge to NIST CSF 2.0 and CISA CPG 2.0 without exposing internal assets. The lack of uploads and external connections removes a typical barrier to adopting new tools in regulated sectors. However, it is necessary to document internally who completed each section and with what expertise, since the output is not verifiable by third parties.

Why It Matters

RAID-AI represents a preliminary step toward standardizing a discipline still in formation: the ransomware resilience of systems that incorporate or are built around artificial intelligence models. The framework is not an automated solution, does not perform scanning, and does not replace detection or incident response tools.

Its utility lies in providing a common language and shared structure for assessing controls that would otherwise remain fragmented between cybersecurity teams and AI teams. At a moment when AI-targeted attacks are emerging — from the alleged theft of models at Novo Nordisk to intrusions orchestrated by the Phantom framework — this common language was missing.

The Phantom framework generated logs of 8,257 messages across 133 sessions, according to secondary sources. These data illustrate a reality in which offensive AI tools are maturing rapidly, making a defensive assessment framework that does not require exposure of internal assets even more relevant.

Frequently Asked Questions

Is RAID-AI an automated scanning tool?

No. RAID-AI requires manual assessment of controls by security teams. It does not perform automatic scans nor independently verify security posture.

Who developed RAID-AI?

Behnaz Karimi and Yuvaraj Govindarajulu, both co-leads of the OWASP AIBOM initiative. The framework is their initiative, not an official OWASP product as an entity.

What distinguishes RAID-AI from other cybersecurity frameworks?

The explicit mapping to MITRE ATLAS and NIST Adversarial, together with controls specific to the AI ecosystem (data, tools, runtime), differentiates it from traditional frameworks focused only on IT infrastructure.

Sources

Sources and references

Get DeafLetter