All 52 threats in full: description, impact, example, mitigations and verified sources.
To the catalogueEffect class and implementation level of the 265 mitigations
Every mitigation in the catalogue carries an effect class and at least one implementation level. The matrix counts how many mitigations fall into each combination. Dense cells show where the catalogue is well covered; empty cells show where your own organisation needs its own answers.
Who it is for: For security and control ownership
Effect matrix
| Effect | Data | Model & training | Application, API & agents | Infrastructure | Use & operations | Organization | Supply chain | Total |
|---|---|---|---|---|---|---|---|---|
| Preventivetakes effect before the attack succeeds | 174 | |||||||
| Detectivemakes the event visible | 114 | |||||||
| Impact-limitinglimits the damage that occurs | · | · | 36 | |||||
| Correctivecorrects the faulty state | · | · | 4 | |||||
| Restorativerestores operation | · | · | · | · | 4 | |||
| Total | 61 | 68 | 166 | 49 | 91 | 38 | 17 | 265 |
Select a cell of the matrix to see the mitigations behind it.
The file shows the current state including any filters and carries the note, catalogue version and source.
The numbers describe the coverage of the catalogue, not the maturity of an organisation. A mitigation with several effect classes or levels appears in every cell that applies; the row and column totals, by contrast, count it only once. A total can therefore be smaller than the sum of its cells.
Versatile AI Risk Assessment is an aid for structuring AI risks and making them transparent. It does not replace legal or professional advice and makes no binding decisions.
Planning mitigations
The same data, a different question
Where mitigations take hold, at which level they act and which part of the organisation has to implement them.
Understanding threats
- Threat pathway How does harm arise?
- Lifecycle When does which risk arise?
- Threat comparison Where does the line between two run?
Placing your own system
- System context Which threats affect my system?
- Architecture change What does a rebuild trigger?
Checking frameworks and evidence
- Framework mappings Where is this anchored professionally and legally?
- Coverage gaps What does my framework not reach?
- Evidence base What is this based on?
Related
From the analysis to the assessment
Four short sections along the EU AI Act for a first, non‑binding orientation of your system.
To the quick checkThe full assessment with system context, threat selection and evidence tracking, free of charge in the browser.
To the live demo