Standardized Threat Taxonomy for AI Security, Governance, and Regulatory Compliance: A Unified Taxonomy of Threat Vectors in Generative and Agentic AI and Machine Learning Systems

Battle Count: 66

The paper has limited direct relevance to quantitative trading. It focuses on AI system risk management and governance rather than financial market modeling. However, indirect relevance exists through: (1) risk quantification methodology (Monte Carlo, VaR) applicable to trading risk; (2) AI governance frameworks relevant to algorithmic trading systems; (3) the CIA-L-R loss framework could inform operational risk in trading firms deploying AI. The paper does not address market risk, portfolio optimization, or trading strategy development.

The taxonomy itself is a structured framework requiring organizational adaptation rather than computational implementation. The quantification workflow (6-step process) requires expertise in probabilistic modeling, Monte Carlo simulation, and financial risk assessment. Mapping to regulatory frameworks requires legal/compliance expertise. The main complexity lies in: (1) calibrating threat-specific probability distributions; (2) integrating with existing enterprise risk management systems; (3) maintaining taxonomy currency as AI threats evolve. The open-source repository reduces some implementation barriers.

Full taxonomy, scenario lists, and mapping files available as open-source on GitHub under CC-BY 4.0 license. Methodology is well-documented with PRISMA guidelines. However, the taxonomy is primarily a structured framework rather than a computational model, limiting traditional reproducibility concerns. Expert-derived parameters for distribution calibration may introduce subjectivity.