New RAID-AI framework helps teams assess ransomware resilience

The Ransomware Assessment and Incident Defense Framework for AI Systems (RAID-AI) has been launched to help cybersecurity leaders identify and address weaknesses that could leave AI systems vulnerable to ransomware. Developed by Behnaz Karimi and Yuvaraj Govindarajulu, co-leads of OWASP’s AI Bill of Materials (AIBOM), RAID-AI is a manual readiness tool delivered via a web console.

It is designed for CISOs, security officers and security engineers to assess controls themselves rather than rely on automated scanning, with the assessment available free online at console.ransomwareinai[.]com. The framework emphasises ransomware threats against AI systems—whether or not attackers deploy AI themselves—and combines general cybersecurity measures with AI-specific considerations across data, tools and runtime.

RAID-AI presents a maturity-based scoring system, where users rate controls on a scale from zero to five, with controls grouped into general and AI-specific categories. General areas include recovery, training and sensitive-data protection, while AI-specific areas cover data, tools and runtime. The framework maps its controls to two voluntary standards, NIST CSF 2.0 and CISA’s CP G 2.0, and supports adversarial mappings via MITRE ATT&CK, MITRE ATLAS and NIST Adversarial.

Documentation explains how maturity levels and security scores are calculated. Looking ahead, the team plans to extend RAID-AI to assess agentic AI systems and to provide practical implementation resources, including videos and blueprints, to help security teams apply the controls. The framework’s results are dashboard-based, with downloadable PDFs to help prioritise remediation and governance discussions.