ENISA AI Threat Landscape Report Unveils Major Cybersecurity Challenges

Today, the European Union Agency for Cybersecurity (ENISA) released its Artificial Intelligence Threat Landscape Report, unveiling the major cybersecurity challenges facing the AI ecosystem. ENISA’s study takes a methodological approach at mapping the key players and threats in AI. The report follows up the priorities defined in the European Commission’s 2020 AI White Paper. The ENISA Ad-Hoc Working Group on Artificial Intelligence Cybersecurity, with members from EU Institutions, academia and industry, provided input and supported the drafting of this report.  

The benefits of this emerging technology are significant, but so are the concerns, such as potential new avenues of manipulation and attack methods. The technology takes many steps across the supply chain and requires vast amounts of data to function efficiently. The AI Threat Landscape report underlines the importance of cybersecurity and data protection in every part of the AI ecosystem to create trustworthy technology for end-users.

Executive Director of the EU Agency for Cybersecurity Juhan Lepassaar said: “Cybersecurity is one of the bases of trustworthy solutions for Artificial Intelligence. A common understanding of AI cybersecurity threats will be key to Europe’s widespread deployment and acceptance of AI systems and applications.”

This new work by ENISA aims to serve as a baseline for initiatives to secure AI: both in terms of policies, as it frames the problem and provides guidance on cybersecurity threats, as well as in terms of technical controls, as it highlights specific threats for which action may be needed. The report is directed to policy makers when developing future guidance on secure AI deployments, to technical experts to support customised risk assessments and to standardisation bodies to support upcoming AI security standards.

The main highlights of the report include:

Definition of AI’s scope in the context of cybersecurity by following a lifecycle approach. The ecosystem of AI systems and applications is defined by taking into account the different stages of the AI lifecycle -- from requirements analysis to deployment.

• Identification of assets of the AI ecosystem as a fundamental step in pinpointing what needs to be protected and what could possibly go wrong in terms of the security of the AI ecosystem.
• Mapping of the AI threat landscape by means of a detailed taxonomy. This serves as a baseline for the identification of potential vulnerabilities and attack scenarios for specific use cases.  
• Classification of threats and listing of relevant threat actors. The impact of threats to different security properties is also highlighted.

The ENISA AI Threat Landscape identifies the challenges and opportunities to deploy secure AI systems and services across the Union. The report highlights the need for more targeted and proportionate security measures to mitigate the identified threats, as well as the need for an in-depth look into AI’s use in sectors such as health, automotive and finance.

Background

The EU Agency for Cybersecurity continues to play a bigger role in the assessment of Artificial Intelligence (AI) by providing key input for future policies.

Earlier this year, the Agency set up the ENISA Ad Hoc Working Group on Cybersecurity for Artificial Intelligence, which supports ENISA in the process of building knowledge on AI Cybersecurity. The group includes members from the European Commission Directorate-General Communications Networks, Content and Technology (DG CONNECT), the European Commission Directorate-General Joint Research Committee (DG JRC), Europol, the European Defence Agency (EDA), the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), the European Telecommunications Standards Institute (ETSI), as well as academics and industry experts.  

On the 30^th of September 2020, Member of European Parliament Eva Kaili and ENISA co-hosted the Cybersecurity for Artificial Intelligence (C4AI) virtual workshop to explore the security challenges related to AI.

The EU Agency for Cybersecurity plans to continue in 2021 its open dialogue with the European Commission and EU Institutions on AI cybersecurity and regulatory initiatives. Additionally, the Agency will come up with mitigation controls for the identified threats and publish relevant guidelines.

Contacts

For questions related to the press and interviews, please contact press (at) enisa.europa.eu