Insights

Fresh thinking and actionable insights that address critical issues your organization faces.

Learn more

Resources

Services

KPMG's multi-disciplinary approach and deep, practical industry knowledge help clients meet challenges and respond to opportunities.

Services to meet your business goals

Technology Alliances

KPMG has market-leading alliances with many of the world's leading software and services vendors.

View all Alliances

Industries

Helping clients meet their business challenges begins with an in-depth understanding of the industries in which they work. That’s why KPMG LLP established its industry-driven structure. In fact, KPMG LLP was the first of the Big Four firms to organize itself along the same industry lines as clients.

How We Work

We bring together passionate problem-solvers, innovative technologies, and full-service capabilities to create opportunity with every insight.

Learn more

Careers & Culture

What is culture? Culture is how we do things around here. It is the combination of a predominant mindset, actions (both big and small) that we all commit to every day, and the underlying processes, programs and systems supporting how work gets done.

Learn more
Relevant Results
Sorry, there are no results matching your search.
Autocomplete suggestions are available. Use up and down arrows to review and enter to select.
See more results

What your AI threat matrix says about your organization

Ready, set, threat

Availability is the name of the game when it comes to why artificial intelligence (AI) has stolen the show as one of the cornerstones of innovation for enterprises today – no longer with the barrier of studying to become a data scientist to apply these models to real business problems. Between January and September in 2023, LinkedIn reported a 60% increase in mentions of generative AI and GAI products and a “head of AI” role tripling in the past five years1. But with this increased footprint comes the call to action to consider the risks that are also brought on stage – to which, we have seen organizations taking steps forward to reduce these risks including taking on the development of an AI Threat Matrix for their organization.

What is an AI Threat Matrix?

While the name alone may have you visualizing a blockbuster movie, this tool is a lot more tactical than a room full of touchscreens and looping videos of zeros and ones on screen. Instead of acting out our favorite Hollywood cyber personas, security teams are working in collaboration with the enterprise to develop an AI threat matrix that connects the dots between the AI use cases (enterprise driven, third-party deployed, and shadow AI cases) and potential vulnerabilities / threats to the security and robustness.

The NIST AI Risk Management Framework 1.0, section 5.2 asserts that, “Outcomes in the MAP function are the basis for the MEASURE and MANAGE functions.” In this order, security teams identify the AI techniques and applications the enterprise is pursuing, and map against relevant attacks and threats as noted in MITRE ATLAS, OWASP Top 10, and AI risk and incident databases2,3,4,5,6. We have also seen the emergence of an AI Threat Matrix published by OWASP to identify threats and risks by stage of AI lifecycle in alignment with this practice as of February 2nd, 20247.

By taking the first step to scope and map scenarios, organizations can begin to communicate the very real risks that are introduced even if other responsible AI principles are being met like fairness or reliability tenants.

Why a Threat Matrix is Essential for Robust AI Security

As described above, an AI threat matrix provides a structured framework to identify, assess, and prioritize potential vulnerabilities and threats to an organization's artificial intelligence systems. With the increasing prevalence of AI in critical business functions, it becomes vital to maintain a high standard of security, as data breaches and cyberattacks can be disastrous to an organization's reputation, financial, and even legal standing. As the NIST AI RMFRMF 1.0 asserts, "organizational policy must take into account the security of the algorithms used, the data that is employed, and the communication between system components" (NIST AI RMF 1.0, p. 13)8,9.

There are three primary reasons why an AI Threat Matrix is essential for AI Security

  1. Proactively identify vulnerabilities: An AI threat matrix helps organizations gain visibility over vulnerabilities that could be targeted by attackers. Early identification can drive preventive measures and infrastructure improvements before attacks occur.
  2. Prioritize potential threats: Not all vulnerabilities carry the same level of risk. An AI threat matrix helps organizations prioritize their security efforts by scoping to the types of use cases planned or in flight for the organization, and assigning risk categorization in alignment with the organization’s risk appetite to various potential attacks.
  3. Compliance and risk management: A well-structured AI threat matrix can assist organizations in meeting compliance requirements and effectively managing cyber risk.

What is Required for an AI Security Threat Matrix?

Creating a AI Threat Matrix involves five critical steps:

  1. Identification of In-Scope AI: Start by taking inventory of the AI techniques (Ex: Machine Learning, Natural Language Processing, Robotics, Deep Learning) and AI application details (Ex: Content generation, anomaly detection, recommendations, chatbots). Proper intake processes, AI risk assessment processes, and overarching AI pipeline management can help contribute to better visibility over the types of AI applications for your enterprise.
  2. Aggregate Inventory of Known Threat Vectors: Leveraging MITRE ATLAS, OWASP Top 10, and emerging research, document potential threat scenarios that are applicable to the use cases scoped for the enterprise.
  3. Threat identification: Map known threat vectors against identified in scope AI use cases to assess the current landscape of risk exposure.
  4. Risk assessment: Assign risk levels to each potential threat based on its potential impact and likelihood of occurrence.
  5. Threat prioritization: Prioritize the threats based on the risk levels assigned to help organizations focus on addressing the most critical vulnerabilities and make informed decisions about resource allocation.

How Organizations May Benefit from an AI Threat Matrix

Once a baseline AI threat matrix is established, the organization can recognize numerous advantages for their security efforts. Here are the top five (5) ways organizations may benefit:

  1. AI Security aligned to Organizational AI Strategy: An AI threat matrix encourages organizations to adopt a detailed approach to AI security, allowing them to address vulnerabilities across different aspects of their AI systems.
  2. Informed Control Mapping: Based on the tailored insights of the organization’s AI threat matrix, their security team can move intelligently into assigning mitigating controls that address their known risk exposure, as well as document formal risk acceptance or transfer if a risk does not currently have a mitigation available today (Examples of this can be found within the NIST AI 100-2e2023 report, Section 4, “Discussion and Remaining Challenges”, Page 50)8,9.
  3. Foundations for Future Testing: Understanding the landscape of AI, threats, and controls allows organizations to prepare procedures to test their specific threat scenarios and evaluate the effectiveness of their control mitigations both for red teaming purposes, routine monitoring, and future auditing.
  4. Effective Resource Allocation: By prioritizing threats based on risk levels, organizations can allocate resources more efficiently, targeting the most pressing issues first.
  5. Enhanced Resilience: Proactive threat identification and management contribute to an organization's ability to withstand and recover from security breaches.

Conclusion:

Ready to scope and map the AI risks to your own organization’s systems, but don’t know where to start? We’ve described the five key steps to creating an AI threat matrix, but it’s a complex process that will differ based on your individual organization’s platforms and capabilities, and you may need help putting it into practice. The KPMG AI Security services team can help, so you can accelerate your ability to identify, assess and prioritize your response to threats to your organization’s critical AI systems and applications. We have extensive experience helping CISOs and their security teams develop and deliver effective AI security solutions, including working with CISOs to develop customized AI threat matrices. Further explore our AI Security services.

Footnotes

  1. Source: Information Week, Carrie Pallardy (November 14, 2022).
  2. Source: Mitre Atlas (2024).
  3. Source: OWASP (2024).
  4. Source: OWASP (2024).
  5. Source: AI Risk Database (2024).
  6. Source: Incident Database (2024).
  7. Source: OWASP (2024).
  8. Source: NIST AI RMFRMF 1.0. (n.d.). National Institute of Standards and Technology. Retrieved from https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf (2023).
  9. Source: NIST AI 100-2e2023, National Institute of Standards and Technology. Retrieved from https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2023.pdf (2023).

Explore more

Insights on cyber security

KPMG professionals are passionate and objective about cyber security. We’re always thinking, sharing and debating. Because when it comes to cyber security, we’re in it together.

Read more

Meet our team

Image of Katie Boswell
Katie Boswell
Managing Director, Cyber Security Services, KPMG US
Read bio
Image of Kristy Hornland
Kristy Hornland
Director Advisory, Cyber Security Services, KPMG US
Read bio
Image of Katie Boswell
Katie Boswell
Managing Director, Cyber Security Services, KPMG US
Read bio
Image of Kristy Hornland
Kristy Hornland
Director Advisory, Cyber Security Services, KPMG US
Read bio

Explore other services tailored to your business

Service
AI security framework design
Read more
Service
Cyber Security Services
Read more

KPMG. Make the Difference.


Some or all of the services described herein may not be permissible for KPMG audit clients and their affiliates or related entities.

The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act upon such information without appropriate professional advice after a thorough examination of the particular situation. KPMG LLP does not provide legal services.

The information contained herein is not intended to be “written advice concerning one or more Federal tax matters” subject to the requirements of section 10.37(a)(2) of Treasury Department Circular 230.

© 2024 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.

For more detail about the structure of the KPMG global organization please visit https://home.kpmg/governance.

Thank you!

Thank you for contacting KPMG. We will respond to you as soon as possible.

Contact KPMG

Use this form to submit general inquiries to KPMG. We will respond to you as soon as possible.

By submitting, you agree that KPMG LLP may process any personal information you provide pursuant to KPMG LLP's Privacy Statement.

An error occurred. Please contact customer support.

Job seekers

Visit our careers section or search our jobs database.

Search now!

Submit RFP

Use the RFP submission form to detail the services KPMG can help assist you with.

Submit

Office locations

View locations

International hotline

You can confidentially report concerns to the KPMG International hotline

Learn more

Press contacts

Do you need to speak with our Press Office? Here's how to get in touch.

Contact

Headline