More of you are testing AI agents now, and a prompt injection that can call internal tools is hard to explain with a CVSS score alone. So we added a calculator built for exactly that, along with a threat modeling favorite.
AIVSS-SSVC is based on the OWASP reference calculator and gives the same results for the same inputs. Set the threat, the vulnerability, and the impact, then score ten capability factors, like how much autonomy the agent has and which tools it can reach. You get a risk score and a clear decision: Defer, Scheduled, Out-of-Cycle, or Immediate.
That’s a score your client can act on, not only a number to argue about.
STRIDE is the opposite: fast and simple. Six switches, one for each threat category. Flip the ones that apply and you’re done.
Both calculators are tabs on every Issue, right next to the others you already use, and the results save straight into your Issue fields. There’s also a standalone page for each one when you just want to run the numbers.
Open any Issue and look for the STRIDE and AIVSS-SSVC tabs. Both ship in Dradis Pro 5.5.0.
Are you assessing AI systems yet? Tell us what you’d want to score next.