CORTEX: Composite Overlay for Risk Tiering and Exposure in Operational AI Systems

TL;DR

CORTEX is a comprehensive multi-layered risk scoring framework for AI systems, combining empirical incident data, technical vulnerability analysis, regulatory context, and probabilistic modeling to assess and manage systemic AI risks.

Contribution

This paper introduces CORTEX, a novel layered risk assessment framework that integrates empirical incident analysis, technical vulnerability categorization, and probabilistic modeling for AI risk management.

Findings

Analyzed over 1,200 AI incidents to identify 29 vulnerability groups.

Developed a five-tier scoring architecture combining likelihood, impact, and contextual factors.

Demonstrated operational use cases in risk registers and governance dashboards.

Abstract

As the deployment of Artificial Intelligence (AI) systems in high-stakes sectors - like healthcare, finance, education, justice, and infrastructure has increased - the possibility and impact of failures of these systems have significantly evolved from being a theoretical possibility to practical recurring, systemic risk. This paper introduces CORTEX (Composite Overlay for Risk Tiering and Exposure), a multi-layered risk scoring framework proposed to assess and score AI system vulnerabilities, developed on empirical analysis of over 1,200 incidents documented in the AI Incident Database (AIID), CORTEX categorizes failure modes into 29 technical vulnerability groups. Each vulnerability is scored through a five-tier architecture that combines: (1) utility-adjusted Likelihood x Impact calculations; (2) governance + contextual overlays aligned with regulatory frameworks, such as the EU AI Act, NIST RMF, OECD principles; (3) technical surface scores, covering exposure vectors like drift, traceability, and adversarial risk; (4) environmental and residual modifiers tailored to context of where these systems are being deployed to use; and (5) a final layered assessment via Bayesian risk aggregation and Monte Carlo simulation to model volatility and long-tail risks. The resulting composite score can be operationalized across AI risk registers, model audits, conformity checks, and dynamic governance dashboards.