FAITH at CyberHOT EU: TrustGuard and AI Risk Assessment
The FAITH project participated in CyberHOT EU, contributing to discussions on cybersecurity and trustworthy artificial intelligence through two training sessions focused on AI risk assessment and cybersecurity risk management. Led by Eleni Tsalapati and Nicholas Fair, the sessions provided participants with hands-on experience with two complementary approaches to assessing and mitigating risks in AI systems.
Hands-On Learning with Cybersecurity Assessment Tools
The first session, “TrustGuard: An In-Isolation AI Risk Assessment System,” introduced the Trustworthiness Assessment Framework (FAITH TAF) developed within FAITH and provided practical training on TrustGuard, a check-list based system designed to identify risks associated with the compromise of key AI trustworthiness characteristics, including safety, security and resilience. Participants explored how the tool assesses risks affecting AI models and data assets throughout the AI lifecycle, from design and development to deployment, and recommends targeted, asset-level controls to support risk mitigation.
TrustGuard follows a checklist-based approach that operationalises the six-phase, risk-based methodology established by the FAITH TAF. By supporting the identification of vulnerabilities and providing asset-level controls for targeted mitigation, it helps users move beyond risk identification towards informed risk management. The approach draws on established European and international standards and guidance, including ISO 27005, ISO 42001, ENISA recommendations and the NIST AI Risk Management Framework.
The second session, “Automating Cybersecurity Risk Assessment Through System Modelling,” focused on the practical application of the Spyderisk System Security Modeller (SSM). Participants learned how to model a basic AI system, taking into account the people, places and processes involved, and use the tool to conduct automated cybersecurity risk assessments, taking into consideration any cascading effects among the assets. The training also covered the interpretation of assessment results and the application of controls and control strategies to model potential mitigations.
Together, the two sessions demonstrated complementary approaches to AI risk assessment: TrustGuard focuses on evaluating trustworthiness risks at the level of individual AI model and data assets (in-isolation), while Spyderisk supports the automated assessment of cybersecurity risks across a wider system context (in-context). By combining practical training with established risk assessment methodologies and standards, the sessions highlighted the importance of systematic risk identification and targeted mitigation in developing and deploying secure and trustworthy AI systems.
Key Takeaways: Building More Trustworthy and Secure AI Systems
FAITH’s participation in CyberHOT EU reinforced several important principles for the responsible development and deployment of AI:
- Assess trustworthiness systematically: Structured frameworks help identify and evaluate risks related to AI safety, security and resilience.
- Consider the entire AI lifecycle: Both models and data assets require attention throughout design, development and deployment.
- Turn assessment into action: Identifying vulnerabilities is only the first step; targeted mitigation measures are essential for effective risk management.
- Combine complementary approaches: AI trustworthiness assessment and system modelling offer valuable perspectives for addressing risks in increasingly complex digital environments.
- Connect principles with practice: Hands-on training helps translate standards and methodologies into practical risk assessment skills.
Through its contribution to CyberHOT EU, the FAITH team highlighted the importance of combining established trustworthiness principles, structured assessment frameworks and practical tools to support the development of AI systems that are safer, more secure, resilient and trustworthy. By advancing practical approaches to AI risk assessment, FAITH continues to support the wider European effort to foster trustworthy AI and strengthen confidence in AI technologies across different application domains.
