Gap analysis

Scoring systems

CVSS 4.0 and OWASP AIVSS v0.8 produce a single security-severity number, collapsed to one scalar with no standing evidence-freshness or confidence layer (CVSS 4.0's Environmental group does capture deployment context, but folds it into the same number rather than preserving it as a separate signal). AIVSS v0.8 fixes its factor weights and adds a 0.67 multiplicative mitigation floor, but keeps a single 0–10 score on three-point factor anchors without operational test methods, and scopes itself to security — by design it does not cover fairness, privacy or transparency. RAISE is a different kind of tool: an academic responsible-AI evaluator (Explainability, Fairness, Robustness, Sustainability) that also rolls up to one score, shown here for breadth rather than as a security scorer.

CVSS 4.0 does have a time-varying dimension — its Threat group (renamed from v3.x Temporal; a single Exploit Maturity metric). But that scores a known vulnerability's exploitation state — is there public exploit code, is it being attacked — set manually from threat intel, with no decay function. A CVSS score never ages on its own. That is a different concept from evidence-freshness decay: AITBM's ACI discounts assessment confidence as evidence goes stale and the system drifts.

Catalogs & taxonomies

OWASP LLM Top 10, OWASP AISVS and MITRE ATLAS enumerate threats and controls; by design they don't output a quantitative score, profile, or temporal model. AITBM maps their elements to evidence for applicable sub-metrics (e.g. LLM01 → Ro-1 + Cn-3); the score then comes from the assessed deployment and its evidence, not from the threat or checklist item alone.

Governance, regulation & certification

NIST AI RMF, ISO 42001, the EU AI Act and AIUC-1 govern, regulate and certify — the EU AI Act imposes binding, risk-tiered obligations; the others classify risk qualitatively or issue pass/fail certificates — but none outputs a quantitative, time-aware score. AIUC-1's agent-identity coverage is thin: the AIVSS–AIUC-1 crosswalk maps about two controls (E016, F001) to agent-identity impersonation, and they are policy-and-disclosure oriented rather than a graduated cryptographic-identity rubric — the depth Cn-5 adds. AITBM can use their attestations and test reports as scoring evidence. AIUC-1's insurance mechanism transfers risk, while AITBM's α = 0.15 floor quantifies a separate assumption of non-zero residual risk; one does not validate the other.