AIVSS as demand signal for SSVC

[ahouseholder]

There is an active OWASP project to create an AI Vulnerability Scoring System (AIVSS): https://github.com/OWASP/www-project-artificial-intelligence-vulnerability-scoring-system

There are a number of ideas encapsulated in their vector elements that could be turned into SSVC decision points if we wanted to. This thread is to capture thoughts on how SSVC should adapt/respond to AIVSS in particular, but also to start conversations about adapting SSVC to model decisions in AI vulnerability/flaw response.

[ahouseholder]

Cross-linking two threads started by @j--- in the OWASP project:

• SSVC thread in Discussion: stakeholder specific vulnerability categorization OWASP/www-project-artificial-intelligence-vulnerability-scoring-system#4 and
• CVSS v3 vs v4 thread in discussion: CVSS v4 OWASP/www-project-artificial-intelligence-vulnerability-scoring-system#5