diff --git a/.github/workflows/validate_artifacts.yml b/.github/workflows/validate_artifacts.yml
index 9cf7b57a..3600f388 100644
--- a/.github/workflows/validate_artifacts.yml
+++ b/.github/workflows/validate_artifacts.yml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v1
-      - name: Set up Python 3.7
+      - name: Set up Python 3.11
         uses: actions/setup-python@v1
         with:
-          python-version: 3.7
+          python-version: 3.11
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
diff --git a/.github/workflows/validate_vrt.yml b/.github/workflows/validate_vrt.yml
index 7b8378f3..bfa189dc 100644
--- a/.github/workflows/validate_vrt.yml
+++ b/.github/workflows/validate_vrt.yml
@@ -9,10 +9,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v1
-    - name: Set up Python 3.7
+    - name: Set up Python 3.11
       uses: actions/setup-python@v1
       with:
-        python-version: 3.7
+        python-version: 3.11
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
diff --git a/Dockerfile b/Dockerfile
index 8824a941..f0da0ce0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,8 @@
-FROM python:3.6
-
-RUN pip install jsonschema GitPython semantic_version
+FROM python:3.11
 
 WORKDIR /tmp/vrt
+ADD . /tmp/vrt
+
+RUN pip install -r lib/requirements.txt
+
 CMD [ "python3", "-B" , "./lib/validate_vrt.py" ]
diff --git a/lib/tests/test_vrt.py b/lib/tests/test_vrt.py
index ea78802f..66976d16 100644
--- a/lib/tests/test_vrt.py
+++ b/lib/tests/test_vrt.py
@@ -7,6 +7,8 @@
 
 class TestVrt(unittest.TestCase):
     def setUp(self):
+        print("\n`---{}---`".format(self._testMethodName))
+        self.vrt = utils.get_json(utils.VRT_FILENAME)
         self.mappings = [
             { 'filename': f, 'name': os.path.splitext(os.path.basename(f))[0] }
             for f in glob.glob(utils.MAPPING_DIR + '/**/*.json', recursive=True) if 'schema' not in f
@@ -43,19 +45,22 @@ def test_mapping_schemas(self):
             self.validate_schema(schema_file, mapping['filename'])
 
     def all_vrt_ids_have_mapping(self, mappping_filename, key):
-        vrt = utils.get_json(utils.VRT_FILENAME)
         mapping = utils.get_json(mappping_filename)
         keyed_mapping = utils.key_by_id(mapping['content'])
-        for vrt_id_list in utils.all_id_lists(vrt, include_internal=False):
-            self.assertTrue(utils.has_mapping(keyed_mapping, vrt_id_list, key),
-                                'no ' + key + ' mapping for ' + '.'.join(vrt_id_list))
+        for vrt_id_list in utils.all_id_lists(self.vrt, include_internal=False):
+            result = utils.has_mapping(keyed_mapping, vrt_id_list, key)
+            if key == 'cwe' and not result:
+                print('WARNING: no ' + key + ' mapping for ' + '.'.join(vrt_id_list))
+            else:
+                self.assertTrue(utils.has_mapping(keyed_mapping, vrt_id_list, key),
+                                    'no ' + key + ' mapping for ' + '.'.join(vrt_id_list))
 
     def test_all_vrt_ids_have_all_mappings(self):
         for mapping in self.mappings:
             self.all_vrt_ids_have_mapping(mapping['filename'], mapping['name'])
 
     def only_map_valid_ids(self, mapping_filename):
-        vrt_ids = utils.all_id_lists(utils.get_json(utils.VRT_FILENAME))
+        vrt_ids = utils.all_id_lists(self.vrt)
         mapping_ids = utils.all_id_lists(utils.get_json(mapping_filename))
         for id_list in mapping_ids:
             self.assertIn(id_list, vrt_ids, 'invalid id in ' + mapping_filename + ' - ' + '.'.join(id_list))
diff --git a/mappings/cvss_v3/cvss_v3.json b/mappings/cvss_v3/cvss_v3.json
index 6f2735f6..56e6611f 100644
--- a/mappings/cvss_v3/cvss_v3.json
+++ b/mappings/cvss_v3/cvss_v3.json
@@ -447,6 +447,63 @@
         }
       ]
     },
+    {
+      "id": "data_biases",
+      "children": [
+        {
+          "id": "representation_bias",
+          "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
+        },
+        {
+          "id": "pre_existing_bias",
+          "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
+        }
+      ]
+    },
+    {
+      "id": "algorithmic_biases",
+      "children": [
+        {
+          "id": "processing_bias",
+          "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
+        },
+        {
+          "id": "aggregation_bias",
+          "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
+        }
+      ]
+    },
+    {
+      "id": "societal_biases",
+      "children": [
+        {
+          "id": "confirmation_bias",
+          "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
+        },
+        {
+          "id": "systemic_bias",
+          "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
+        }
+      ]
+    },
+    {
+      "id": "misinterpretation_biases",
+      "children": [
+        {
+          "id": "context_ignorance",
+          "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
+        }
+      ]
+    },
+    {
+      "id": "developer_biases",
+      "children": [
+        {
+          "id": "implicit_bias",
+          "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N"
+        }
+      ]
+    },
     {
       "id": "sensitive_data_exposure",
       "children": [
@@ -828,31 +885,31 @@
       ]
     },
     {
-    "id": "physical_security_issues",
-    "children": [
-      {
-        "id": "bypass_of_physical_access_control",
-        "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
-      },
-      {
-        "id": "weakness_in_physical_access_control",
-        "children": [
-          {
-            "id": "cloneable_key",
-            "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
-          },
-          {
-            "id": "master_key_identification",
-            "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
-          },
-          {
-            "id": "commonly_keyed_system",
-            "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
-          }
-        ]
-      }
-    ]
-  },
+      "id": "physical_security_issues",
+      "children": [
+        {
+          "id": "bypass_of_physical_access_control",
+          "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
+        },
+        {
+          "id": "weakness_in_physical_access_control",
+          "children": [
+            {
+              "id": "cloneable_key",
+              "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
+            },
+            {
+              "id": "master_key_identification",
+              "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
+            },
+            {
+              "id": "commonly_keyed_system",
+              "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
+            }
+          ]
+        }
+      ]
+    },
     {
       "id": "insecure_os_firmware",
       "children": [
@@ -873,7 +930,7 @@
             }
           ]
         },
-       {
+        {
           "id": "weakness_in_firmware_updates",
           "children": [
             {
@@ -889,54 +946,54 @@
               "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
             }
           ]
-        },      
-  {
-    "id": "kiosk_escape_or_breakout",
-    "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
-  },
-  {
-    "id": "poorly_configured_disk_encryption",
-    "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
-  },
-  {
-    "id": "shared_credentials_on_storage",
-    "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
-  },
-  {
-    "id": "over_permissioned_credentials_on_storage",
-    "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
-  },
-  {
-    "id": "local_administrator_on_default_environment",
-    "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
-  },
-  {
-    "id": "poorly_configured_operating_system_security",
-    "cvss_v3": "AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"
-  },
-  {
-    "id": "recovery_of_disk_contains_sensitive_material",
-    "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
-  },
-  {
-    "id": "failure_to_remove_sensitive_artifacts_from_disk",
-    "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
-  },
-  {
-    "id": "data_not_encrypted_at_rest",
-    "children": [
-      {
-        "id": "non_sensitive",
-        "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
-      },
-      {
-        "id": "sensitive",
-        "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
-      }
-    ]
-  } 
- ]
-},
+        },
+        {
+          "id": "kiosk_escape_or_breakout",
+          "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
+        },
+        {
+          "id": "poorly_configured_disk_encryption",
+          "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+        },
+        {
+          "id": "shared_credentials_on_storage",
+          "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+        },
+        {
+          "id": "over_permissioned_credentials_on_storage",
+          "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+        },
+        {
+          "id": "local_administrator_on_default_environment",
+          "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
+        },
+        {
+          "id": "poorly_configured_operating_system_security",
+          "cvss_v3": "AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"
+        },
+        {
+          "id": "recovery_of_disk_contains_sensitive_material",
+          "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+        },
+        {
+          "id": "failure_to_remove_sensitive_artifacts_from_disk",
+          "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+        },
+        {
+          "id": "data_not_encrypted_at_rest",
+          "children": [
+            {
+              "id": "non_sensitive",
+              "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
+            },
+            {
+              "id": "sensitive",
+              "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+            }
+          ]
+        }
+      ]
+    },
     {
       "id": "cryptographic_weakness",
       "children": [
diff --git a/mappings/cwe/cwe.json b/mappings/cwe/cwe.json
index e7b953b6..1866223c 100644
--- a/mappings/cwe/cwe.json
+++ b/mappings/cwe/cwe.json
@@ -751,6 +751,68 @@
     {
       "id": "indicators_of_compromise",
       "cwe": null
+    },
+    {
+      "id": "data_biases",
+      "cwe": null,
+      "children": [
+        {
+          "id": "representation_bias",
+          "cwe": null
+        },
+        {
+          "id": "pre_existing_bias",
+          "cwe": null
+        }
+      ]
+    },
+    {
+      "id": "algorithmic_biases",
+      "cwe": null,
+      "children": [
+        {
+          "id": "processing_bias",
+          "cwe": null
+        },
+        {
+          "id": "aggregation_bias",
+          "cwe": null
+        }
+      ]
+    },
+    {
+      "id": "societal_biases",
+      "cwe": null,
+      "children": [
+        {
+          "id": "confirmation_bias",
+          "cwe": null
+        },
+        {
+          "id": "systemic_bias",
+          "cwe": null
+        }
+      ]
+    },
+    {
+      "id": "misinterpretation_biases",
+      "cwe": null,
+      "children": [
+        {
+          "id": "context_ignorance",
+          "cwe": null
+        }
+      ]
+    },
+    {
+      "id": "developer_biases",
+      "cwe": null,
+      "children": [
+        {
+          "id": "implicit_bias",
+          "cwe": null
+        }
+      ]
     }
   ]
 }
diff --git a/mappings/remediation_advice/remediation_advice.json b/mappings/remediation_advice/remediation_advice.json
index 0f45b455..ffe20d61 100644
--- a/mappings/remediation_advice/remediation_advice.json
+++ b/mappings/remediation_advice/remediation_advice.json
@@ -1,7 +1,10 @@
 {
   "metadata": {
     "default": null,
-    "keys": ["remediation_advice", "references"]
+    "keys": [
+      "remediation_advice",
+      "references"
+    ]
   },
   "content": [
     {
@@ -56,7 +59,9 @@
         {
           "id": "same_site_scripting",
           "remediation_advice": "As a best practice, do not resolve targets or hostnames to 127.0.0.1 or similar addresses.",
-          "references": ["http://seclists.org/bugtraq/2008/Jan/270"]
+          "references": [
+            "http://seclists.org/bugtraq/2008/Jan/270"
+          ]
         },
         {
           "id": "ssl_attack_breach_poodle_etc",
@@ -104,7 +109,9 @@
             {
               "id": "missing_caa_record",
               "remediation_advice": "As the domain name holder you can modify the DNS zone file to specify one or more Certification Authorities (CAs) authorized to issue certificates for that domain.",
-              "references": ["https://tools.ietf.org/html/rfc6844"]
+              "references": [
+                "https://tools.ietf.org/html/rfc6844"
+              ]
             }
           ]
         },
@@ -163,7 +170,9 @@
             {
               "id": "excessively_privileged_user_dba",
               "remediation_advice": "Ensure that the current DBMS session user has the least amount of privilege necessary.",
-              "references": ["https://www.owasp.org/index.php/Least_privilege"]
+              "references": [
+                "https://www.owasp.org/index.php/Least_privilege"
+              ]
             }
           ]
         },
@@ -241,7 +250,9 @@
         {
           "id": "cookie_scoped_to_parent_domain",
           "remediation_advice": "If possible do not set the domain for the session cookie. If domain is not set, so by default, the cookie will be a host only cookie, meaning accessible explicitly to the domain from which it was set.",
-          "references": ["https://tools.ietf.org/html/rfc6265"]
+          "references": [
+            "https://tools.ietf.org/html/rfc6265"
+          ]
         },
         {
           "id": "missing_secure_or_httponly_cookie_flag",
@@ -287,7 +298,9 @@
             {
               "id": "account_takeover",
               "remediation_advice": "Ensure correct implementation of OAuth protocol in order to protect client secrets and tokens, and provide secure access controls.",
-              "references": ["https://tools.ietf.org/html/rfc6819"]
+              "references": [
+                "https://tools.ietf.org/html/rfc6819"
+              ]
             },
             {
               "id": "account_squatting",
@@ -525,7 +538,9 @@
         {
           "id": "bitsquatting",
           "remediation_advice": "As a best practice, consider registering any potential bitsquatting domain names.",
-          "references": ["http://dinaburg.org/bitsquatting.html"]
+          "references": [
+            "http://dinaburg.org/bitsquatting.html"
+          ]
         }
       ]
     },
@@ -615,7 +630,9 @@
             {
               "id": "external_authentication_injection",
               "remediation_advice": "Even if unsafe HTML tags like `<script>` or `<iframe>` are filtered out from user input, it is possible to inject `HTTP 401` authentication prompt into a HTML page via tags like `<img>`. In order to prevent this type of injection consider the following solutions:\n\n1. Always treat all user input as untrusted data.\n2. Always input or output encode all data coming into or out of the application.\n3. Always whitelist allowed characters and seldom use blacklisting of characters unless in certain use cases.\n4. Always use a well known and security encoding API for input and output encoding such as the `OWASP ESAPI`.\n5. Never try to write input and output encoders unless absolutely necessary. Chances are that someone has already written a good one.",
-              "references": ["https://www.exploit-db.com/papers/12898/"]
+              "references": [
+                "https://www.exploit-db.com/papers/12898/"
+              ]
             },
             {
               "id": "flash_based_external_authentication_injection",
@@ -839,14 +856,18 @@
             {
               "id": "oauth_secret",
               "remediation_advice": "Consider using OAuth Implicit Grant to avoid hardcoding the OAuth secret key within the application.",
-              "references": ["https://tools.ietf.org/html/rfc6749#section-4.2"]
+              "references": [
+                "https://tools.ietf.org/html/rfc6749#section-4.2"
+              ]
             }
           ]
         },
         {
           "id": "xssi",
           "remediation_advice": "1. Avoid placing sensitive content inside JavaScript files, and also not in `JSONP`.\n2. Consider using a CSRF token.\n3. Sensitive scripts should only respond to POST requests.\n4. Append some non-executable prefix to the response body.\n5. Usage of the response header `X-Content-Type-Options: nosniff` and usage of the correct `Content-Type` is also helpful in reducing the chance of XSSI.",
-          "references": ["https://www.scip.ch/en/?labs.20160414"]
+          "references": [
+            "https://www.scip.ch/en/?labs.20160414"
+          ]
         },
         {
           "id": "json_hijacking",
@@ -878,7 +899,9 @@
         {
           "id": "trace_method",
           "remediation_advice": "As the TRACE method can be utilized to bypass certain protections, consider disabling the HTTP method TRACE.",
-          "references": ["https://www.owasp.org/index.php/Cross_Site_Tracing"]
+          "references": [
+            "https://www.owasp.org/index.php/Cross_Site_Tracing"
+          ]
         }
       ]
     },
@@ -1253,7 +1276,7 @@
               "remediation_advice": "Implementation of encryption for firmware updates allows for the update data to be protected during transit, and increases the time taken to reverse engineer the firmware used, and future security patches."
             }
           ]
-        }                
+        }
       ]
     },
     {
@@ -1363,7 +1386,9 @@
             {
               "id": "use_of_predictable_salt",
               "remediation_advice": "When a hash is computing using a predictable salt, the protections afforded by the salt are diminished, leaving the hash vulnerable to rainbow table attacks.  Always use a unique and randomly-generated value for the salt, and ensure the length of the salt (in terms of bits) is sufficiently large to prevent brute force attacks.  As a general rule, salts used in cryptographic operations should be at least 8 bytes (64 bits) in length.",
-              "references": ["https://www.rfc-editor.org/rfc/rfc2898#page-7"]
+              "references": [
+                "https://www.rfc-editor.org/rfc/rfc2898#page-7"
+              ]
             },
             {
               "id": "predictable_hash_collision",
@@ -1594,7 +1619,9 @@
         {
           "id": "tapjacking",
           "remediation_advice": "Ensure that the setting filterTouchesWhenObscured is set to true, or that the method onFilterTouchEventForSecurity() is implemented in your app.",
-          "references": ["https://blog.devknox.io/tapjacking-android-prevent/"]
+          "references": [
+            "https://blog.devknox.io/tapjacking-android-prevent/"
+          ]
         },
         {
           "id": "clipboard_enabled",
@@ -1885,7 +1912,9 @@
             {
               "id": "sybil_attack",
               "remediation_advice": "Known approaches to Sybil attack prevention include identity validation, social trust graph algorithms, or economic costs, personhood validation, and application-specific defenses.",
-              "references": ["https://en.wikipedia.org/wiki/Sybil_attack"]
+              "references": [
+                "https://en.wikipedia.org/wiki/Sybil_attack"
+              ]
             }
           ]
         }
@@ -1933,6 +1962,87 @@
     {
       "id": "indicators_of_compromise",
       "remediation_advice": ""
+    },
+    {
+      "id": "data_biases",
+      "children": [
+        {
+          "id": "representation_bias",
+          "remediation_advice": "Diversify data sources and ensure the dataset represents all relevant groups proportionally to prevent skewing model outcomes.",
+          "references": [
+            "https://fairmlbook.org"
+          ]
+        },
+        {
+          "id": "pre_existing_bias",
+          "remediation_advice": "Identify and correct biases in the data collection phase, and review historical data for any inherent biases that could affect outcomes.",
+          "references": [
+            "https://ai.google/responsibilities/responsible-ai-practices/"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "algorithmic_biases",
+      "children": [
+        {
+          "id": "processing_bias",
+          "remediation_advice": "Design algorithms to process all data fairly, implementing checks to detect and mitigate biases that arise during data processing.",
+          "references": [
+            "https://paperswithcode.com/task/fairness-in-ml"
+          ]
+        },
+        {
+          "id": "aggregation_bias",
+          "remediation_advice": "Ensure that data aggregation methods maintain the integrity of subgroups, preventing dilution of minority data.",
+          "references": [
+            "https://www.microsoft.com/en-us/ai/responsible-ai-resources"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "societal_biases",
+      "children": [
+        {
+          "id": "confirmation_bias",
+          "remediation_advice": "Promote a culture of critical thinking and questioning in analysis to avoid confirming pre-existing beliefs or hypotheses.",
+          "references": [
+            "https://hbr.org/2019/05/the-problem-with-confirmation-bias"
+          ]
+        },
+        {
+          "id": "systemic_bias",
+          "remediation_advice": "Review and reform policies and practices that lead to unfair advantages or disadvantages for specific groups across systems.",
+          "references": [
+            "https://www.brookings.edu/research/how-to-combat-systemic-bias/"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "misinterpretation_biases",
+      "children": [
+        {
+          "id": "context_ignorance",
+          "remediation_advice": "Include contextual information in the analysis and interpretation phases to avoid misinterpreting data or trends.",
+          "references": [
+            "https://contextualscience.org/contextualism"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "developer_biases",
+      "children": [
+        {
+          "id": "implicit_bias",
+          "remediation_advice": "Implement training programs to raise awareness and reduce the impact of unconscious biases among developers.",
+          "references": [
+            "https://implicit.harvard.edu/implicit/takeatest.html"
+          ]
+        }
+      ]
     }
   ]
 }
diff --git a/third-party-mappings/remediation_training/secure-code-warrior-links.json b/third-party-mappings/remediation_training/secure-code-warrior-links.json
index 35198535..9247bf20 100755
--- a/third-party-mappings/remediation_training/secure-code-warrior-links.json
+++ b/third-party-mappings/remediation_training/secure-code-warrior-links.json
@@ -288,6 +288,19 @@
   "insecure_data_transport.executable_download": null,
   "insecure_data_transport.executable_download.no_secure_integrity_check": "https://integration-api.securecodewarrior.com/api/v1/trial?id=bugcrowd&mappingList=vrt&mappingKey=insecure_data_transport:executable_download:no_secure_integrity_check&redirect=true",
   "insecure_data_transport.executable_download.secure_integrity_check": "https://integration-api.securecodewarrior.com/api/v1/trial?id=bugcrowd&mappingList=vrt&mappingKey=insecure_data_transport:executable_download:secure_integrity_check&redirect=true",
+  "data_biases": null,
+  "data_biases.representation_bias": null,
+  "data_biases.pre_existing_bias": null,
+  "algorithmic_biases": null,
+  "algorithmic_biases.processing_bias": null,
+  "algorithmic_biases.aggregation_bias": null,
+  "societal_biases": null,
+  "societal_biases.confirmation_bias": null,
+  "societal_biases.systemic_bias": null,
+  "misinterpretation_biases": null,
+  "misinterpretation_biases.context_ignorance": null,
+  "developer_biases": null,
+  "developer_biases.implicit_bias": null,
   "physical_security_issues": null,
   "physical_security_issues.bypass_of_physical_access_control": null,
   "physical_security_issues.weakness_in_physical_access_control": null,
diff --git a/vulnerability-rating-taxonomy.json b/vulnerability-rating-taxonomy.json
index bed03ede..07aad2cb 100644
--- a/vulnerability-rating-taxonomy.json
+++ b/vulnerability-rating-taxonomy.json
@@ -1807,43 +1807,126 @@
       ]
     },
     {
-  "id": "physical_security_issues",
-  "name": "Physical Security Issues",
-  "type": "category",
-  "children": [
+      "id": "data_biases",
+      "name": "Data Biases",
+      "type": "category",
+      "children": [
+        {
+          "id": "representation_bias",
+          "name": "Representation Bias",
+          "type": "subcategory",
+          "priority": null
+        },
+        {
+          "id": "pre_existing_bias",
+          "name": "Pre-existing Bias",
+          "type": "subcategory",
+          "priority": null
+        }
+      ]
+    },
     {
-      "id": "bypass_of_physical_access_control",
-      "name": "Bypass of physical access control",
-      "type": "subcategory",
-      "priority": null
+      "id": "algorithmic_biases",
+      "name": "Algorithmic Biases",
+      "type": "category",
+      "children": [
+        {
+          "id": "processing_bias",
+          "name": "Processing Bias",
+          "type": "subcategory",
+          "priority": null
+        },
+        {
+          "id": "aggregation_bias",
+          "name": "Aggregation Bias",
+          "type": "subcategory",
+          "priority": null
+        }
+      ]
     },
     {
-      "id": "weakness_in_physical_access_control",
-      "name": "Weakness in physical access control",
-      "type": "subcategory",
+      "id": "societal_biases",
+      "name": "Societal Biases",
+      "type": "category",
       "children": [
         {
-          "id": "cloneable_key",
-          "name": "Cloneable Key",
-          "type": "variant",
+          "id": "confirmation_bias",
+          "name": "Confirmation Bias",
+          "type": "subcategory",
           "priority": null
         },
         {
-          "id": "master_key_identification",
-          "name": "Master Key Identification",
-          "type": "variant",
+          "id": "systemic_bias",
+          "name": "Systemic Bias",
+          "type": "subcategory",
+          "priority": null
+        }
+      ]
+    },
+    {
+      "id": "misinterpretation_biases",
+      "name": "Misinterpretation Biases",
+      "type": "category",
+      "children": [
+        {
+          "id": "context_ignorance",
+          "name": "Context Ignorance",
+          "type": "subcategory",
+          "priority": null
+        }
+      ]
+    },
+    {
+      "id": "developer_biases",
+      "name": "Developer Biases",
+      "type": "category",
+      "children": [
+        {
+          "id": "implicit_bias",
+          "name": "Implicit Bias",
+          "type": "subcategory",
+          "priority": null
+        }
+      ]
+    },
+    {
+      "id": "physical_security_issues",
+      "name": "Physical Security Issues",
+      "type": "category",
+      "children": [
+        {
+          "id": "bypass_of_physical_access_control",
+          "name": "Bypass of physical access control",
+          "type": "subcategory",
           "priority": null
         },
         {
-          "id": "commonly_keyed_system",
-          "name": "Commonly Keyed System",
-          "type": "variant",
-          "priority": 2
+          "id": "weakness_in_physical_access_control",
+          "name": "Weakness in physical access control",
+          "type": "subcategory",
+          "children": [
+            {
+              "id": "cloneable_key",
+              "name": "Cloneable Key",
+              "type": "variant",
+              "priority": null
+            },
+            {
+              "id": "master_key_identification",
+              "name": "Master Key Identification",
+              "type": "variant",
+              "priority": null
+            },
+            {
+              "id": "commonly_keyed_system",
+              "name": "Commonly Keyed System",
+              "type": "variant",
+              "priority": 2
+            }
+          ]
         }
       ]
-    }
-  ]
-},
+    },
     {
       "id": "insecure_os_firmware",
       "name": "Insecure OS/Firmware",
@@ -1874,7 +1957,7 @@
             }
           ]
         },
-         {
+        {
           "id": "weakness_in_firmware_updates",
           "name": "Weakness in Firmware Updates",
           "type": "subcategory",
@@ -1896,58 +1979,58 @@
               "name": "Firmware is not encrypted",
               "type": "variant",
               "priority": 5
-            }                        
-      ]
-    },
-          {
+            }
+          ]
+        },
+        {
           "id": "kiosk_escape_or_breakout",
           "name": "Kiosk Escape or Breakout",
           "type": "subcategory",
           "priority": null
         },
-          {
+        {
           "id": "poorly_configured_disk_encryption",
           "name": "Poorly Configured Disk Encryption",
           "type": "subcategory",
           "priority": null
         },
-          {
+        {
           "id": "shared_credentials_on_storage",
           "name": "Shared Credentials on Storage",
           "type": "subcategory",
           "priority": 3
         },
-          {
+        {
           "id": "over_permissioned_credentials_on_storage",
           "name": "Over-Permissioned Credentials on Storage",
           "type": "subcategory",
           "priority": 2
-        },       
-          {
+        },
+        {
           "id": "local_administrator_on_default_environment",
           "name": "Local Administrator on default environment",
           "type": "subcategory",
           "priority": 2
         },
-          {
+        {
           "id": "poorly_configured_operating_system_security",
           "name": "Poorly Configured Operating System Security",
           "type": "subcategory",
           "priority": null
         },
-          {
+        {
           "id": "recovery_of_disk_contains_sensitive_material",
           "name": "Recovery of Disk Contains Sensitive Material",
           "type": "subcategory",
           "priority": null
         },
-          {
+        {
           "id": "failure_to_remove_sensitive_artifacts_from_disk",
           "name": "Failure to Remove Sensitive Artifacts from Disk",
           "type": "subcategory",
           "priority": null
         },
-         {
+        {
           "id": "data_not_encrypted_at_rest",
           "name": "Data not encrypted at rest",
           "type": "subcategory",
@@ -1963,9 +2046,9 @@
               "name": "Non sensitive",
               "type": "variant",
               "priority": 5
-            }                       
+            }
           ]
-        }                     
+        }
       ]
     },
     {
@@ -2584,7 +2667,7 @@
           "id": "llm_security",
           "name": "Large Language Model (LLM) Security",
           "type": "subcategory",
-          "children":[
+          "children": [
             {
               "id": "prompt_injection",
               "name": "Prompt Injection",