Opening article
Cloud Security Alliance and Noma Security, alongside contributors Haize Labs and Harmonic Security, have launched RiskRubric.ai to provide standardized risk assessments for AI models. The platform evaluates models across six pillars to generate 0-100 scores and A-F letter grades, helping developers navigate the open model ecosystem.
Building trust in the open model ecosystem through standardized risk assessment
More than 500,000 models can be found on the Hugging Face hub, but it’s not always clear to users how to choose the best model for them, notably on the security aspects. Developers might find a model that perfectly fits their use case, but have no systematic way to evaluate its security posture, privacy implications, or potential failure modes.
As models become more powerful and adoption accelerates, we need equally rapid progress in AI safety and security reporting. We're therefore excited to announce RiskRubric.ai , a novel initiative led by Cloud Security Alliance and Noma Security , with contributions by Haize Labs and Harmonic Security, for standardized and transparent risk assessment in the AI model ecosystem.
When risk assessments are public and standardized, the entire community can work together to improve model safety. Developers can see exactly where their models need strengthening, and the community can contribute fixes, patches, and safer fine-tuned variants. This creates a virtuous cycle of transparent improvement that's impossible with closed systems. It also helps the community at large understand what works and does not, safety wise, by studying best models.
RiskRubric.ai provides consistent, comparable risk scores across the entire model landscape , by evaluating models across six pillars: transparency, reliability, security, privacy, safety, and reputation.
The platform's approach aligns perfectly with open-source values: rigorous, transparent, and reproducible. Using Noma Security capabilities to automate the effort, each model undergoes:
These assessments produce 0-100 scores for each risk pillar, rolling up to clear A-F letter grades. Each evaluation also includes specific vulnerabilities found, recommended mitigations, and suggestions for improvements.
Standardized, public risk assessments give developers a systematic way to evaluate security and privacy postures across both open and closed models. This transparency helps organizations set minimum safety thresholds for deployment and fosters community-driven improvements.