Vulnerabilities

Explanation

Vulnerabilities checks each component of an AI system for known security weaknesses, so that exploitable flaws in models, libraries, or dependencies are surfaced and fixed before they can be used against a bank's systems — a single unpatched critical vulnerability in a serving library or dependency can expose customer data or allow system compromise. It is measured by the Vulnerability Count per Component: the number of known vulnerabilities found in each component, typically broken down by severity. No explicit calculation method is given, so implement it by running automated vulnerability and dependency scanners against every component listed in the SBOM, mapping findings to severity (e.g. via CVE/CVSS data), and logging per-component counts, severities, and remediation status for audit. Run these scans continuously and as a gate in the CI/CD and deployment pipeline, and re-scan when new vulnerabilities are disclosed for already-deployed components. The threshold is 0 critical/high vulnerabilities, with an alert on any occurrence: the appearance of even one critical or high-severity vulnerability in any component is a breach that fires the control and triggers prompt patching, mitigation, or component replacement — consistent with its Immediate priority.