Ransomware has spent years hitting hospitals, factories and city governments. Now the systems that run artificial intelligence are becoming part of the target list. A new tool called the Ransomware Assessment and Incident Defense Framework for AI Systems, or RAID-AI, gives security teams a structured way to examine those weaknesses before attackers do. That is a sensible response to a risk that has been growing quietly.
The framework was developed by Behnaz Karimi, co-lead of the Open Worldwide Application Security Project's AI Bill of Materials initiative, with Yuvaraj Govindarajulu, also a co-lead on that effort. It is free to use online. Karimi says it focuses on ransomware attacks against AI systems, whether or not the attacker uses AI, and it asks security teams to assess their own controls rather than scanning their systems. That design choice matters. A tool that never touches an organization's network avoids new risk, though it also means results are only as honest as the people filling in the assessment.
Karimi pointed to two examples she said show the threat is real: a report from April 2025 describing ransomware actors using data poisoning techniques, and an alleged June 2026 cyber-attack on Novo Nordisk in which hackers claimed to have stolen AI models used by the pharmaceutical company. The second is an allegation, not a confirmed finding, and readers should treat it that way. Even so, it shows why AI models and training data belong in an organization's ransomware planning alongside email and backups.
The framework maps its controls to NIST's Cybersecurity Framework 2.0 and CISA's Cybersecurity Performance Goals 2.0, and it links attacks to MITRE ATT&CK, MITRE ATLAS and NIST's adversarial taxonomy. Users rate their maturity on a scale from zero to five and receive dashboards and downloadable PDF reports. Karimi suggested running the assessment in workshops that bring managers, engineers and AI-security specialists together. I agree. A self-rated score from one person in one meeting will overstate readiness. Cross-functional discussion is how the gaps get found.
Chief information security officers should not treat RAID-AI as a finished answer. It is a self-assessment, not an audit, and it cannot confirm that a control works. What it can do is force a conversation about recovery, sensitive data and AI-specific risks that many organizations have not yet had. Start there, then test the results against real incident response drills.