Lesson 5 of 10 · 11 min read
The threat catalogue: how ISO/IEC 27090 classifies threats
Last updated:
ISO/IEC 27090 classifies every AI security threat on four dimensions: the first asset it hits, the security objective it breaks, whether it concerns predictive or generative AI, and whether it is intentional or accidental. Nine threats are described in detail in clause 6, and three AI versions of conventional attacks sit in Annex B. Every entry has the same four parts: characterisation, consequences, detection and mitigation.
In this lesson you will learn to
- 01
Name the four dimensions the standard uses to classify a threat
- 02
Describe the four parts of every threat entry
- 03
List the twelve threats and say which are in Annex B
- 04
Use the catalogue to build threat scenarios for a specific system
Four dimensions of classification
Every threat in the catalogue is tagged on four dimensions. The first asset hit: the model, training data, test data, output or the service itself. The security objective affected: confidentiality, integrity or availability. The type of AI concerned: predictive or generative. And the occurrence: an intentional attack or an accidental failure.
These tags are what make the catalogue usable in an assessment. A team assessing a predictive scoring model with no external exposure can set aside the generative-only threats and concentrate on evasion, poisoning and inference attacks. A team assessing a public chatbot built on a vendor model does the reverse.
The four parts of every entry
Each threat is described in the same structure, roughly a page per threat. Characterisation explains what the attack is and how it is carried out. Consequences describe what breaks and who is affected. Detection lists the signals and tests that reveal the attack. Mitigation sets out the controls that reduce likelihood or impact.
The structure is deliberately reusable. The templates in lesson 10 copy it: a risk assessment row per threat records the asset, the objective, likelihood and impact, the existing controls, the gap and the treatment.
The twelve threats at a glance
Nine threats receive a full entry in clause 6. Three further threats are AI versions of conventional attacks and sit in Annex B, because the ISO/IEC 27002 controls already in place handle them. The next three lessons take the nine in turn; the Annex B entries are covered alongside the threats they resemble.
| # | Threat | Asset hit first | Objective | Where |
|---|---|---|---|---|
| 1 | Data poisoning | Training data | Integrity | Clause 6 |
| 2 | Evasion | Model | Integrity | Clause 6 |
| 3 | Membership inference | Training data (via the model) | Confidentiality | Clause 6 |
| 4 | Model inversion | Training data (via the model) | Confidentiality | Clause 6 |
| 5 | Model exfiltration | Model | Confidentiality | Clause 6 |
| 6 | Direct model poisoning | Model | Integrity | Clause 6 |
| 7 | Sensitive model output | Output | Confidentiality | Clause 6 |
| 8 | Prompt injection | Service / input | Integrity | Clause 6 |
| 9 | Output containing injection attacks | Output | Integrity of downstream systems | Clause 6 |
| B1 | Direct model theft | Model | Confidentiality | Annex B |
| B2 | Leakage of training data | Training data | Confidentiality | Annex B |
| B3 | Leakage of input data | Input | Confidentiality | Annex B |
Annex B: conventional attacks in AI form
Annex B exists because some attacks on AI systems are ordinary attacks with an AI-specific target. Copying a model file from a repository is theft of a file. Reading training data from an unprotected store is a data breach. Exposing user prompts through logs or caches is a confidentiality failure in logging. Flooding an inference endpoint is denial of service. Introducing a malicious library, data set or notebook tool is a supply-chain compromise.
The standard keeps these in an annex to make a point: the controls for them already exist in ISO/IEC 27002. Access control, encryption, repository hygiene, secrets management, classification, separation of environments, rate limits, capacity planning and supplier assessment apply directly. What is new is only the asset list those controls must cover.
Using the catalogue in threat modelling
The catalogue is most useful as the threat source in an existing risk process rather than as a separate exercise. For each AI system in the inventory, walk the twelve threats, filter by AI type and exposure, and score likelihood and impact for the ones that apply. Then build two or three concrete scenarios per high-scoring threat: who the attacker is, what they do, what they gain, and what the organization would see.
Those scenarios become the brief for red teaming and the acceptance criteria for testing. Combined with MITRE ATLAS for technique detail, the catalogue gives a red team a realistic playbook rather than a generic checklist.
Reviewers note that the catalogue focuses on deliberate attacks. Add the organization’s own accidental failure modes, such as a broken data pipeline or an unreviewed configuration change, so the scenario set is complete.
Key terms
- Threat catalogue
- The structured list of threats in clause 6 and Annex B of ISO/IEC 27090, each with characterisation, consequences, detection and mitigation.
- First asset hit
- The asset an attack targets initially: model, training data, test data, output or service. One of the four classification dimensions.
- Annex B threat
- An AI-specific version of a conventional attack, handled by existing ISO/IEC 27002 controls.
- Threat scenario
- A concrete description of an attacker, their actions, their gain and the observable signs, built from a catalogue threat for a specific system.
In one paragraph
Clause 6 of ISO/IEC 27090 tags each threat by first asset hit, security objective, AI type and intent, and describes it in four parts: characterisation, consequences, detection and mitigation. Nine threats are detailed: data poisoning, evasion, membership inference, model inversion, model exfiltration, direct model poisoning, sensitive model output, prompt injection and output containing injection attacks. Three conventional attacks in AI form, direct model theft and leakage of training or input data, sit in Annex B.
Lesson 5 quiz
Five questions. Score 4 or more to mark the lesson complete. Each answer shows an explanation, so a wrong answer teaches as much as a right one.
Questions people ask
- How many threats does ISO/IEC 27090 describe?
- Twelve in total: nine described in detail in clause 6 and three AI versions of conventional attacks in Annex B. Independent summaries of the final draft count the same twelve; some count a thirteenth category depending on how Annex B is read.
- What are the four parts of a threat entry?
- Characterisation (what the attack is), consequences (what breaks), detection (signals and tests) and mitigation (controls).
- Why are some threats in Annex B rather than clause 6?
- Because they are conventional attacks with an AI-specific target, such as stealing a model file, and the ISO/IEC 27002 controls already handle them. The annex records the AI assets those controls must cover.
Shahzad Asghar
Senior IT Strategy and Portfolio Officer at UNRWA, with more than twenty years building and securing data and AI systems across UN agencies. He holds the CISM and CISSP security certifications and writes on AI governance, AI security and assurance, and digital transformation. Connect on LinkedIn.
This course is an independent educational resource by Shahzad Asghar. It is not affiliated with, endorsed by or published by ISO or IEC. ISO/IEC 27090:2026 is copyrighted and is sold through the ISO Store and national standards bodies; this course summarises it and does not reproduce its text. Last reviewed: .