AI security frameworks: OWASP, MITRE ATLAS and NIST mapping
OWASP LLM Top 10 (2026 and 2025 IDs), OWASP agentic IDs, MITRE ATLAS techniques and NIST AI RMF mapped to AI security findings. None is a certification.
Short answer
We map each finding to public frameworks so your team and your buyers can place it: the OWASP Top 10 for LLM Applications (2026 edition), the OWASP Top 10 for Agentic Applications, MITRE ATLAS technique IDs and NIST AI RMF with the AI 600-1 profile. These are reference lists, not certifications, and a mapping does not mean you comply.
Each finding in our reports carries references to public frameworks. They help your team sort findings and help buyers recognize them. A mapping shows where a finding sits in a public list. It is not a certification and does not show that you comply with anything.
How do findings map to the OWASP Top 10 for LLM Applications?#
The current edition is the 2026 list, published August 4, 2026. The 2025 edition (version released November 2024) used different IDs for some entries, so we show both. Source: OWASP 2026 README and the 2025 PDF.
| Our test area | 2026 entry | 2025 entry |
|---|---|---|
| Direct and indirect prompt injection | LLM01:2026 Prompt Injection | LLM01:2025 |
| Sensitive data exposure | LLM02:2026 Sensitive Information Disclosure | LLM02:2025 |
| Tool permissions, approval, unintended actions | LLM03:2026 Excessive Agency | LLM06:2025 |
| Tool, plugin and model sourcing; MCP server adoption | LLM04:2026 Supply Chain | LLM03:2025 |
| Poisoned documents or memory | LLM05:2026 Data and Model Poisoning | LLM04:2025 |
| Cost and resource abuse | LLM06:2026 Unbounded Consumption | LLM10:2025 |
| Prompt and hidden context extraction | LLM08:2026 Hidden Context Exposure | LLM07:2025 System Prompt Leakage |
| Retrieval boundaries, cross-tenant leakage | LLM09:2026 Vector and Embedding Weaknesses | LLM08:2025 |
| Markdown, HTML and link handling | LLM10:2026 Improper Output Handling | LLM05:2025 |
LLM07:2026 Misinformation covers wrong output that people trust. We test it only when you put it in scope, for example for a support bot that states policy.
How do findings map to OWASP agentic AI work?#
OWASP published the Top 10 for Agentic Applications on December 9, 2025. Its IDs run ASI01 to ASI10. We use these IDs where an agent is in scope:
- ASI01 Agent Goal Hijack
- ASI02 Tool Misuse
- ASI03 Identity and Privilege Abuse
- ASI04 Agentic Supply Chain Vulnerabilities
- ASI06 Memory and Context Poisoning
- ASI09 Human-Agent Trust Exploitation
OWASP also published "Agentic AI: Threats and Mitigations" (February 17, 2025) as a threat-model reference. The AI agent assessment applies these lists.
How do findings map to MITRE ATLAS?#
MITRE ATLAS is a knowledge base of adversary tactics and techniques. We cite IDs from data release v2026.10 (October 28, 2026). Examples:
| ID | Technique | Where we use it |
|---|---|---|
| AML.T0051.000 | LLM Prompt Injection: Direct | Direct injection tests |
| AML.T0051.001 | LLM Prompt Injection: Indirect | Hostile documents, pages, tickets |
| AML.T0053 | AI Agent Tool Invocation | Unintended tool calls |
| AML.T0070 | RAG Poisoning | Planted retrieval content |
| AML.T0080 | AI Agent Context Poisoning | Memory and context tests |
| AML.T0086 | Exfiltration via AI Agent Tool Invocation | Data sent out through a tool |
| AML.T0110 | AI Agent Tool Poisoning | Hostile MCP tool descriptions |
| AML.T0136 | Exfiltration via AI User Interface | Links and images in output |
IDs change between releases. The older "LLM Data Leakage" ID AML.T0057 is not in v2026.10, so we do not cite it.
How do findings map to NIST?#
NIST AI RMF 1.0 (NIST AI 100-1, January 26, 2023) is a voluntary framework. The Generative AI Profile, NIST AI 600-1 (July 2024), is a companion resource. Its suggested action MS-2.7-007 calls for AI red-teaming to assess resilience against, among others, prompt injection. We cite such actions when a buyer's form uses NIST language. NIST says on its AI RMF page that the AI RMF 1.0 is being revised, so check the current text.
What do these frameworks not do?#
No assessment of ours gives you a badge or an attestation of compliance, and we do not promise that a buyer or regulator accepts a report. For buyer review questions see AI security questionnaires. Our methodology describes how we test, and the example report is a labeled sample.
Questions
Does a framework mapping mean we are compliant?
No. OWASP lists, MITRE ATLAS and the NIST AI RMF are voluntary references, and NIST describes the AI RMF as voluntary. A mapping helps you place a finding but does not certify a product.
Why does your page use the 2026 OWASP list and not 2025?
OWASP published the 2026 edition on August 4, 2026. Some buyer forms still cite the 2025 IDs. We show both so you can answer either.
Sources
- OWASP Top 10 for LLM Applications 2026 (README) (checked 9 November 2026)
- OWASP Top 10 for LLM Applications 2025 (PDF) (checked 9 November 2026)
- OWASP Top 10 for Agentic Applications (blog, December 9, 2025) (checked 9 November 2026)
- MITRE ATLAS data release v2026.10 (checked 9 November 2026)
- NIST AI RMF 1.0 publication page (checked 9 November 2026)
- NIST AI 600-1: Generative AI Profile (checked 9 November 2026)
Shipping an AI feature or agent?
Describe the system, the data it reads and the actions it can take. We reply with questions and a proposed scope.