## 3 Methodology
### Comparison Between AI Agents and Expert Survey  
When comparing the AI-driven evaluations with the human-centric insights gathered from the expert user survey, several points of convergence and divergence emerge, revealing the complementary strengths of algorithmic and experiential approaches to cybersecurity risk assessment. Both the AI agents and the user survey strongly agree that network-based attacks pose the greatest threat to autonomous vehicles, with high-severity classifications assigned to attacks such as replay, Sybil, eavesdropping, falsified information, and cloaking. This shared emphasis on network vulnerabilities highlights the critical importance of securing vehicular communication systems, particularly as vehicles become increasingly interconnected through protocols like V2X. The consensus also extends to the impact dimensions of these attacks. Both AI and user perspectives identify integrity and availability as the most commonly compromised security properties, reflecting the potentially catastrophic consequences of data manipulation and system outages in safety-critical automotive functions. Furthermore, there is a uniform recognition that most attacks do not require user interaction, thereby making them difficult to detect and prevent using traditional user-centric security mechanisms like alerts or permissions. This insight underscores the necessity for embedded and autonomous cybersecurity measures that can operate without user mediation. Nevertheless, the comparison also uncovers key differences that highlight the unique vantage points of human experts versus AI systems. One notable divergence is in the assessment of attack complexity. While AI engines such as ChatGPT and Copilot tended to rate many attacks as low in complexity, suggesting a heightened concern about widespread, easily executed threats, the user survey leaned toward classifying a greater number of attacks as high complexity. This disparity may stem from human evaluators' greater awareness of real-world implementation constraints and their understanding of layered vehicular architectures that can introduce additional barriers to exploitation. Privilege requirements also reveal a point of divergence. The AI engines predominantly assessed attacks as requiring little to no privileges, possibly due to their assumption of idealized or default system configurations. In contrast, the user survey suggested that many of the more severe attacks, such as impersonation, Sybil, and falsified information attacks, often necessitate elevated access levels or pre-existing footholds within the system. This discrepancy may be due to the practitioners' awareness of real-world defensive architectures that add layers of privilege enforcement not always visible in abstract threat modeling. Another area of contrast lies in the perceived importance of confidentiality. AI agents such as Gemini and DeepSeek frequently rated attacks like eavesdropping, relay, and timing as serious confidentiality threats, while the user survey assigned higher weight to integrity and availability. This could indicate that practitioners are more focused on threats that disrupt system functionality and decision-making processes, whereas AI engines, trained on diverse datasets, may give equal or heightened consideration to data leakage risks. Furthermore, the AI engines tended to cover a wider spectrum of attack vectors--including physical, local, and adjacent vectors--than the user survey, which focused predominantly on network-based attacks. This broader scope may reflect the AI tools' systematic and exhaustive analytical frameworks, while human experts may prioritize more immediate and commonly encountered threats based on their domain experience. Taken together, these differences underscore the value of synthesizing AI-based and human-centered analyses in the cybersecurity risk evaluation process. AI engines offer breadth, consistency, and computational rigor, while expert users provide depth, context-awareness, and practical insight grounded in real-world experience.