AIVSS Calculator

OWASP AIVSS 1.0 · Reference Calculator

Score an agentic AI finding

Start from an OWASP Agentic Top 10 example, or set the metrics yourself. The severity number stays ordinary CVSS v4.0. You also get an effect class and, if you need one, a CISA BOD 26-04 remediation deadline.

Start from an example Loading examples…
CVSS v4.0 · Base
CVSS v4.0 · Threat
CVSS v4.0 · Environmental (optional; Not Defined by default)
Agentic AI Profile · classifying metrics

LC, CP, AP and SR determine the Agentic AI Effect Class. X records insufficient evidence; it is not a benign default.

Agentic AI Profile · assurance metrics

EX, PT, CA and TD are descriptive and do not change the score.

Remediation timeline · SSVC / BOD 26-04 (Level 2)

OWASP Agentic Top 10 examples

Synthetic reference fixtures demonstrating AIVSS calculation, SSVC Layer 3 remediation analogies, and the A2 candidate overlay — not real incidents. Open any example in the calculator to explore it.