⚡ Quick Summary
Published by the European Union Agency for Cybersecurity (ENISA), this report maps the cybersecurity threat landscape for artificial intelligence, with its principal focus on securing AI itself. It presents a lifecycle-based view of AI systems, geared towards machine learning while also considering broader AI assets including data, infrastructure, algorithms and platforms. The report is horizontal and sector-agnostic: it does not assess particular application domains.
The report links three elements: an AI lifecycle reference model, a taxonomy of assets requiring protection, and a taxonomy of threats and threat actors. Its lifecycle covers business goal definition, data ingestion and preparation, feature selection, model selection and training, tuning, transfer learning, deployment, maintenance and business understanding. Assets are grouped into data, models, actors, processes, environment/tools and artefacts. The threat taxonomy identifies 74 threats across nefarious activity/abuse, eavesdropping/interception/hijacking, physical attacks, unintentional damage, failures or malfunctions, outages, disasters and legal threats. It maps threats to assets and lifecycle stages, principally through confidentiality, integrity and availability, while relating these to robustness, trustworthiness, safety, transparency, explainability, accountability and data protection.
🧩 What’s Covered
The report proceeds from scope and method to a lifecycle model, asset inventory and threat mapping:
- Context, scope and audiences: The introduction distinguishes cybersecurity for AI, AI used to support cybersecurity, and malicious use of AI. The stated main focus is cybersecurity of AI, particularly machine learning, rather than AI ethics or sector-specific applications. It identifies public authorities, industry, technical and cybersecurity communities, academia, standardisation bodies and civil society as intended audiences.
- AI lifecycle reference model: The lifecycle starts with business goals and proceeds through data ingestion, exploration, pre-processing and feature selection, then model selection/building, training, tuning, transfer learning, deployment, maintenance and business understanding. The report describes the data transformations, roles and processes associated with each phase, including cross-validation, hyper-parameter optimisation, monitoring for concept drift and retraining.
- Lifecycle actors and dependencies: It identifies AI designers and developers, data scientists, data engineers, data owners, data providers or brokers, model providers, cloud and third-party providers, end users and service consumers. This frames AI as a multi-party ecosystem rather than a standalone model-development exercise.
- Asset taxonomy: The report classifies assets into six categories: data, model, actors, processes, environment/tools and artefacts. Annex A defines examples ranging from raw, training, testing and validation data to models, hyper-parameters, access-control lists, data governance policies, libraries, cloud services, monitoring tools and model hardware designs.
- Threat-modelling method: Following ENISA's threat-landscape approach, the method sets out five steps: objectives identification, system survey, asset identification, threat identification and vulnerability identification. It uses confidentiality, integrity and availability as fundamental properties, then maps their effects on AI-specific properties such as robustness, safety and explainability.
- Threat taxonomy and mappings: The report describes threat actors including cybercriminals, insiders, nation-state actors, terrorists, hacktivists, script kiddies and competitors. Annex B details 74 threats, including adversarial examples, data poisoning, model backdoors, model disclosure, manipulation of data or labels, weak encryption, outages and physical attacks; Annexes C and D map assets and threats to lifecycle stages.
- Conclusions and future direction: The conclusion calls for an AI toolbox of concrete mitigation measures based on risk assessments, context-specific sectoral assessments, further research, and attention to AI supply-chain security and integrity.
💡 Why it matters?
The report provides a common structure for examining AI security across the full system lifecycle, rather than treating a deployed model as the only asset that can fail or be attacked. It helps teams identify which data, processes, model components, providers and technical environments are implicated by a threat, and whether confidentiality, integrity or availability are affected.
For governance and assurance work, its lifecycle mappings support more targeted risk assessments and the selection of proportionate security measures. It also makes clear that AI security involves third-party relationships: data brokers, cloud providers, model providers, libraries and other elements of an AI/ML supply chain can all affect system operation and security.
❓ What’s Missing
This is a baseline threat landscape, not a control catalogue or a sector-specific risk assessment. Although its conclusion calls for an AI toolbox of concrete mitigation measures, it does not provide that toolbox. The report says that vulnerability identification has not been extensively explored because this requires specific use cases, and it does not rank threats by likelihood. Its lifecycle reference model is oriented towards machine learning and acknowledges that other AI sub-fields, such as reasoning systems and robotics, would need targeted models. It also states that threats to cloud infrastructure, communications networks and data-collecting sensors are only briefly covered and should be assessed alongside other ENISA threat landscapes. Data-protection threats are considered only in the context of AI security; GDPR compliance requirements are expressly outside scope.
👥 Best For
AI security leads, risk managers and technical teams conducting early-stage threat modelling for machine-learning systems. It is particularly useful for teams mapping assets, owners and dependencies across data preparation, training, deployment and maintenance, and for organisations examining risks introduced by cloud, model and data providers in the AI supply chain.
📄 Source Details
AI Cybersecurity Challenges: Threat Landscape for Artificial Intelligence is a 74-page English report published by the European Union Agency for Cybersecurity (ENISA) in December 2020. Apostolos Malatras and Georgia Dede are listed as editors. The document gives ISBN 978-92-9204-462-6, DOI 10.2824/238222 and reference TP-01-20-772-EN-N.
