Why this analysis has no ERS
The source combines an Internet-wide exposure study, several unrelated vector-database deployments, credential validation against external SaaS systems, and two different Milvus vulnerabilities with separate preconditions and fixed versions. There is no single assessed database, architecture, dependency graph, or remediation state. Combining them into one score would conflate population prevalence, two software defects, and several organizations' configurations.
Classification: Validated Research · source date 2026-08-05
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleAIDEFEND dataVersion 2026.08.05. Inventory the Milvus versions and image digests actually running, compare them with both advisories, rebuild on a currently supported fixed release, stage the rollout, and use fleet readback to prove that vulnerable instances have exited. This directly closes the two product defects; network controls remain necessary but do not substitute for the vendor fixes. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Ro-4 Tr-4 |
| AID-I-002.001 | Internal AI Network SegmentationAIDEFEND dataVersion 2026.08.05. Place vector data and management interfaces in dedicated private segments, then enforce default-deny, port-specific rules between exact workloads. Removing public reachability and blocking Milvus port 9091 from unapproved peers prevents an external caller from reaching the vulnerable handlers in the first place. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Cn-4 |
| AID-H-005.005 | Embedding & Vector Store ConfidentialityAIDEFEND dataVersion 2026.08.05. Remove secrets and unnecessary personal data before embedding, encrypt vector stores and backups, and restrict raw-record and vector exports. These controls directly reduce the information Orca found at risk, although encryption at rest cannot protect records returned through a compromised live API. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Pr-1 Pr-4 |
| AID-H-004.002 | Service & API AuthenticationAIDEFEND dataVersion 2026.08.05. Require every data and management route, including internal handlers, to authenticate an explicit workload identity and authorize it for the requested operation. Mutual TLS and workload credentials prevent callers from gaining authority merely by supplying a trusted-looking header, but this control must accompany rather than replace Milvus upgrades. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-5 Tr-3 |
| AID-E-001.001 | Root & Long-Lived Credential Object EvictionAIDEFEND dataVersion 2026.08.05. If a vector store actually exposed passwords, API keys, client secrets, or long-lived certificates, revoke or rotate the exact incident-scoped credential population at its authoritative issuers and update every consumer. This ends continued use of the leaked credential objects; it does not retroactively prevent the original disclosure. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-5 |
| AID-M-001.005 | Public AI Endpoint & Agent-Service Exposure DiscoveryAIDEFEND dataVersion 2026.08.05. Scan from an external vantage point without enterprise credentials, verify which vector and administrative routes are genuinely reachable, and reconcile each service with its owner, environment, authentication requirement, and approved exposure. This finds orphaned or accidentally public deployments, but a discovery result still requires a separate remediation owner. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Cn-5 Fa-3 Tr-4 |