Toward Quantitative Modeling of Cybersecurity Risks from AI Misuse

The researchers release a technical report that applies a quantitative risk modeling method to AI-enabled cyberattacks, building nine cyber risk models to analyze the attack capability uplift brought by AI. Each model decomposes attacks into steps according to the MITRE ATT&CK framework, estimating how AI affects the number of attackers, attack frequency, probability of success, and harm caused; estimates are produced jointly by a human expert Delphi study and LLM-based simulated experts, mapping Cybench and BountyBench benchmark scores to risk model factors, then aggregating via Monte Carlo simulation. Results show systematic increases in attack effectiveness, speed, and reach of targets, with different risk models having different uplift mechanisms. The authors hope the method helps security teams prioritize mitigations, evaluators design benchmarks, developers make deployment decisions, and policymakers set risk thresholds, and note that the estimates have substantial uncertainty, and that public quantitative results help experts locate disagreements and jointly revise estimates.