Dear CIO,

Cybersecurity has always been a constant battle of cat and mouse, and right now, a new player has entered the field: Artificial Intelligence. AI and large language models (LLMs) become increasingly integrated into our daily lives and critical systems, creating a new, complex, and rapidly evolving attack surface. We're witnessing a fresh wave of vulnerabilities, and the truth is, we're still learning how to identify, prioritize, and remediate them.

A new white paper, NIST CSWP 41, titled "Likely Exploited Vulnerabilities: A Proposed Metric for Vulnerability Exploitation Probability," introduces a Likely Exploited Vulnerabilities (LEV) metric. While this metric is designed to help with all software and hardware vulnerabilities, its principles could be compelling for navigating the complexities of AI and LLM security. In this newsletter, I will review what all this information means for you.

Best Regards,
John, Your Enterprise AI Advisor

A New Metric for a New Era: Introducing LEV

NIST recently released a draft white paper, CSWP 41, that proposes a new metric for security professionals called Likely Exploited Vulnerabilities (LEV). The concept is that instead of just predicting what might be exploited, LEV looks at whether there is evidence that a vulnerability has already been exploited by analyzing trends in historical exploitation probabilities.

Tens of thousands of vulnerabilities are published annually, but only a tiny fraction ever get exploited in the wild. The challenge for security teams is figuring out which ones to fix first, a task made difficult by the sheer volume and the cost of remediation.

Currently, organizations often rely on Known Exploited Vulnerabilities (KEV) lists, which can be helpful, but are often reactive and incomplete, and the Exploit Prediction Scoring System (EPSS), which tries to forecast future exploitation risk but can be unreliable, especially for already exploited issues.

LEV adds a retrospective view, identifying the vulnerabilities that show signs of prior exploitation—even if they never made it onto a KEV list. It essentially turns EPSS into a rearview mirror, spotting patterns that point to real-world attacker interest.

What Makes LEV Worth Your Time?

In practice, LEV offers four key benefits:

Why LEV Could Be a Game-Changer for AI Security

Let’s bring this back to AI and LLMs. The threat landscape here is still being mapped. If we are being honest, prompt injection, data poisoning, training-data leaks, and model evasion are just the start, and we are in the early innings of understanding how to secure these systems. In such a volatile environment, being able to identify which AI-specific vulnerabilities are attracting attacker attention could be the edge we need.

Here’s how LEV might help:

A Useful Tool, But Not a Crystal Ball

I want to make one thing clear, though. LEV doesn’t predict future attacks. It doesn’t replace human judgment. Instead, it is a backward-looking signal, not a forecasting tool. But in cybersecurity, where every insight can be a force multiplier, that backward look may be exactly what’s needed to improve forward-looking strategies.

NIST itself is calling for more industry participation to validate LEV using real-world exploitation data. For AI and LLMs, where ground truth is scarce and attacker tactics are still evolving, that validation will be critical.

The Bottom Line for CIOs

AI is becoming part of the infrastructure, and that means the vulnerabilities we’re seeing today are cracks in the foundation of tomorrow’s systems. CIOs can’t afford to wait for perfect tools or mature lists to start managing this risk. LEV is not the end-all, but it is a meaningful step toward smarter prioritization in a domain that desperately needs it.