AgentReadyHomeAgent Listing

← Vidan.ai

Vidan.ai — agentic threat model

8.8AIVSS 8.8 · High

Vidan.ai is a high-risk video analytics agent due to its integration with physical security monitoring (intrusion, weapon, and fire detection). A compromise could lead to severe real-world safety failures, undetected physical breaches, or unauthorized surveillance and privacy violations.

OWASP AIVSS score rationale

AIVSS = (CVSS_Base + AARS) × Mitigation_Factor, where AARS = (10 − CVSS_Base) × (Factor_Sum / 10) × ThM
CVSS base 8.2AARS uplift 0.57Factor sum 3.0/10Threat ×1.05Mitigation ×1.0
Autonomy of Action
0.40
Goal-Driven Planning
0.20
Self-Modification
0.00
Dynamic Tool Use
0.30
Persistent Memory
0.20
Contextual Awareness
0.70
Dynamic Identity
0.00
Multi-Agent Interactions
0.00
Non-Determinism
0.40
Opacity & Reflexivity
0.80

Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.

MAESTRO 7-layer threat model

Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.

L1 · Foundation Models⚠ not certain from listing

Not certain from the listing — likely utilizes specialized computer vision models (such as CNNs or ViTs) for object, facial, and hazard detection. Primary threats include physical adversarial attacks (e.g., adversarial patches that blind the model to weapons or intruders) and model evasion.

L2 · Data Operations⚠ not certain from listing

Not certain from the listing — processes real-time video streams and potentially stores reference data like facial templates or license plate watchlists. Threats include unauthorized access to sensitive video feeds, data exfiltration of private surveillance data, and poisoning of reference databases.

L3 · Agent Frameworks⚠ not certain from listing

Not certain from the listing — orchestration appears to be a pipeline connecting video ingestion to alerting and reporting mechanisms. Threats include manipulation of alert thresholds or suppression of critical security events.

L4 · Deployment & Infrastructure⚠ not certain from listing

Not certain from the listing — likely deployed on edge devices near cameras or in a centralized cloud. Threats include compromise of edge hardware, interception of unencrypted RTSP video streams, and unauthorized access to local network segments.

L5 · Evaluation & Observability⚠ not certain from listing

Not certain from the listing — requires continuous monitoring to detect camera tampering, occlusion, or model drift due to environmental changes (e.g., lighting). Threats include silent failures where the system stops detecting hazards without alerting administrators.

L6 · Security & Compliance (cross-cutting)⚠ not certain from listing

Not certain from the listing — facial recognition and license plate tracking trigger strict regulatory requirements (e.g., GDPR, EU AI Act high-risk categorization). Threats include non-compliance, lack of user consent mechanisms, and insufficient audit logging of who accessed surveillance data.

L7 · Agent Ecosystem⚠ not certain from listing

Not certain from the listing — no multi-agent or marketplace ecosystem is described. Threats are limited to downstream integrations with third-party physical security systems or notification APIs failing to deliver critical alerts.

MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).