Threat Identification
40 points• Memory attacks✓✗✗✗✗✗?
• Tool/API abuse✓✓✗✗✗✗?
• Privilege escalation✓✓✗✗✗✗?
• Multi-agent threats✓✗✗✗✗✗?
• Temporal behaviors✓✗✗✗✗✗?
• Human manipulation✓✓✗✗✗✗?
• Communication poisoning✓✓✗✗✗✗?
• Identity/auth threats✓✓✗✗✗✗?
Subtotal (40 pts)40/4025/400/400/400/400/40Draft
Practical Guidance
30 points• Clear patterns✓✓✓✓✓✗?
• Specific tools✓✗✗✗✗✗?
• Checklists✓✗✓✓✓✗?
• Architecture diagrams✓✓✗✗✗✗?
• Step-by-step instructions✓✗✓✓✓✗?
Subtotal (30 pts)30/3015/3020/3020/3020/300/30Draft
Evidence Quality
20 points• Credible research✓✓✓✓✓✗?
• Real incidents✓✓✗✗✓✗?
• Attack patterns✓✓✗✗✗✗?
• Detection guidance✓✓✓✗✗✗?
Subtotal (20 pts)20/2020/2010/205/2010/200/20Draft
Frameworks (ranked)OWASPATLASISO42kNISTCISATT&CKISO27k
✓ = Criteria met | ✗ = Criteria not met | ? = Unknown
Scores out of 100 points total. Ranked from highest to lowest coverage.
ISO27k (ISO/IEC 27090) is draft - content not available.