LLM Application Threat Catalogue
Catalogues prompt injection, data leakage, excessive agency, insecure output handling and related threats with controls.
Available soon
- Format
- Excel
- Size
- 71 KB
- Length
- 10 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this workbook contains. The Threat Catalogue has one row for each threat (LT-01 to LT-12). The Controls sheet shows the 31 requirements of the Generative AI Security Standard (GS-01 to GS-31) against the threats. The Coverage sheet counts what the catalogue holds and what you have entered. It has no total score. |
| 2 | Why it exists. An LLM application puts instructions and data in one channel. The model reads the organisation's instructions and an attacker's words as the same kind of thing, so the checks that work for ordinary input, such as matching a field against a pattern, cannot tell them apart. The national cyber centres and OWASP both say the defence lies in the system around the model, because the model will sometimes be fooled. Everything the organisation already does for access, logging, secure development, patching and supplier assurance still applies and is not repeated here. This pack adds what is specific: what the model may read, what its output may reach, what it may do, who approves what it does, and how the organisation tests all of this before release and watches it afterwards. The result is counts of features reviewed, checks verified and findings open. It is never one score. |
| 3 | Select the threats for each feature (stage RP-2 of the LLM Application Security Review Procedure). Mark each row in "Applies to us (from your threat selection)" as Yes, No or Not yet assessed. Name the features it applies to. If you leave a threat out, write the reason: a reviewer will ask. The Head of Information Security selects the threats and sets the review depth. |
| 4 | Read the requirements. The "Requirements that answer it" column gives the GS IDs. The Controls sheet gives the words of each requirement, which the Generative AI Security Standard holds. The rules on which AI may be used, with which data, who approves a use and how a use is recorded are P24's (AG-01 to AG-22). This pack does not change them. It sets what a generative AI feature has to do to be secure once a use is approved, and what the organisation checks before the feature goes live and while it runs. |
| 5 | Run the tests. Each row lists tests for its threat. At the depth the review sets, the team runs them, or an independent tester runs them under the AI Red Team Test Plan Template. Record the date, the result and any finding ID from the AI Security Findings & Exceptions Register. A test that finds no problem does not show that a feature is secure. |
| 6 | Watch for the signals. Each row lists the signals that suggest the threat is happening. Report an event at once through the incident route (P09 IM-01). Nobody is blamed for a report made in good faith. P09 decides whether it is an incident and whether anything must be reported, and P18's clocks apply. P09 IM-07 sets the order of containing and preserving. Where harm can still spread, such as an agent that can still act (AS-03, AS-07, AS-08) or data still leaving, contain first by switching the feature's access off, and capture what you can in the same step. Otherwise preserve the evidence first, then switch the feature off. |
| 7 | Name an owner for every threat that applies to you. Use "Last tested" and "Test result" so that anyone can see what is tested and what is not. |
| 8 | Read the Coverage sheet. It counts the requirements, tests, signals and ATLAS techniques for each threat, and how many of your entries are made. A count says how much is written down or recorded. It does not say how well a feature does what a requirement asks. |
| 9 | Review the catalogue at least every 12 months, when OWASP or MITRE publishes a new edition, when an incident shows a gap, and when the Generative AI Security Standard changes. To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow column. The threats stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps you secure the generative AI your organisation builds, configures or buys. It is not legal advice, and following it is not a statement that you comply with the EU AI Act, the GDPR or any standard. A test that finds no problem does not show that a feature is secure. Whether the Act binds you, in which role, and which of its duties apply to each system depends on the facts: confirm it with counsel.
The sources. OWASP, MITRE ATLAS, NIST AI 600-1, NIST SP 800-218A, the NCSC blog, the NCSC and CISA guidelines and the joint agency guidance on agents are voluntary guidance. They are not law, and none of them says what the AI Act or the GDPR requires. This pack cites them as their publishers state them. The OWASP lists are community lists of the risks the project judges most important. A threat that is not on a list is not therefore safe, and a threat on a list is not therefore present in every application.
How the sources are cited. The source reference is in the words of OWASP or MITRE ATLAS, with the 2026 entry names. One threat, LT-12, takes its reference from OWASP's list for agents. This pack does not say which OWASP, MITRE ATLAS, NIST or ISO/IEC 42001 items meet a requirement of the EU AI Act or the GDPR. Each reference says what its source asks for and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.
EXAMPLE: the distributor of the earlier packs, with about 900 staff, as at 30 Sep 2026. Its answers in the yellow columns come from three records: the red team test planned for its customer-service chatbot (RTP-2026-01), which selects eleven of the twelve threats, the reason it gives for leaving one out, and the one finding on the office-suite assistant. The chatbot is on hold, so most of the test results read "Not tested". The other rows are left to you. Its figures are invented and identify no real company.
Tailoring — small organisation: one person may select the threats, own them and run the tests. Keep every row and write a reason for each threat you leave out, so a reviewer can follow your choice.
Tailoring — regulated or critical sector: threats that touch personal data (LT-03, LT-10) and actions in the world (LT-04) usually need an independent tester. Name the sector rules that apply to you in the reason column.
Tailoring — service provider or outsourced IT: where a provider hosts or runs the model, the threat is still yours. Name the provider, the contract and your own owner, and ask the provider the questions in the AI Vendor & Model Provider Security Questionnaire.
Threat Catalogue
The 12 threats. The yellow columns are yours. Source references are as OWASP and MITRE ATLAS state them.
A threat that is not here is not therefore safe. Add rows in your own copy for threats specific to your features, and give each an ID.
| Row | ID | Threat | OWASP LLM Top 10 2026 class | Source reference, as the source states it | MITRE ATLAS techniques (MITRE ATLAS 2026.09) | What it is | Example attack | Impact | Requirements that answer it (Standard, GS-nn) | Tests | Detection signals | Applies to us (from your threat selection) | Features it applies to | Reason if left out | Owner | Last tested | Test result | Finding IDs (register) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | LT-01 | Direct prompt injection | LLM01 Prompt Injection | OWASP Top 10 for LLM Applications 2026: LLM01:2026 Prompt Injection | AML.T0051.000 — LLM Prompt Injection: Direct AML.T0054 — LLM Jailbreak AML.T0068 — LLM Prompt Obfuscation | A person types or pastes input that changes what the model does: an instruction to ignore its rules, a role-play, text in another language or in an encoding. | A customer tells the order-status chatbot to ignore its instructions and list the orders of other customers. | Disclosure of data the person should not see, actions outside the feature's purpose, or harmful or off-brand output. | GS-01, GS-02, GS-03, GS-04, GS-05, GS-06, GS-18, GS-19, GS-20, GS-24, GS-28, GS-29, GS-30, GS-31 | • Send a maintained set of override and role-play prompts, including encoded text and other languages. • Try to make the feature leave its task and answer on any subject. • Try to reach data of another person by any phrasing. | AS-01 (P24 AT-6): Output that quotes the system prompt or tool list, or many near-identical requests asking the model to repeat its instructions. AS-02 (P24 AT-6): A spike in refusals or filter hits from one account, or one account sending many variations of the same request. | Yes | LF-3 | Chief Operating Officer (LF-3) | Not tested | |||
| EXAMPLE | LT-02 | Indirect prompt injection | LLM01 Prompt Injection | OWASP Top 10 for LLM Applications 2026: LLM01:2026 Prompt Injection | AML.T0051.001 — LLM Prompt Injection: Indirect AML.T0068 — LLM Prompt Obfuscation | The model reads content from a document, web page, email, ticket, tool result or retrieved passage that carries instructions, and follows them. The user did not write them and may not see them. | A supplier's price list has hidden white text telling an assistant that summarises it to say that the supplier is approved and its invoices need no review. The summary repeats the line. | The model's output or actions serve the attacker. With tools, the damage reaches whatever the tools can reach. | GS-01, GS-02, GS-03, GS-04, GS-07, GS-13, GS-14, GS-18, GS-19, GS-20, GS-24, GS-25, GS-27, GS-28, GS-29, GS-30, GS-31 | • Plant instructions in documents, web pages, emails, tickets, images and tool results the feature reads, in plain, hidden and encoded forms. • Check what the feature says and does after reading them. • Check that a summary shows only what the source holds. | AS-03 (P24 AT-6): Output or a tool call that follows content the feature has just read, and that the person did not ask for. AS-04 (P24 AT-6): Output that contains addresses, images or encoded text that are not in the source and not asked for. | Yes | LF-1, LF-3 | Head of IT (LF-1); Chief Operating Officer (LF-3) | 18 Sep 2026 | Partly tested | AF-001 | |
| EXAMPLE | LT-03 | Sensitive information disclosure | LLM02 Sensitive Information Disclosure | OWASP Top 10 for LLM Applications 2026: LLM02:2026 Sensitive Information Disclosure | AML.T0057 — LLM Data Leakage | The feature exposes confidential, regulated or personal data through a channel nobody authorised: the answer, a tool call, a retrieved passage, a log, a trace, a cache or the supplier's own use of the data. | Prompts that include customer contracts are written to a monitoring tool every engineer can read. A supplier setting keeps prompts for model improvement. | Leak of Confidential or personal data, a breach of confidentiality terms, and a personal data breach where personal data is involved. | GS-01, GS-03, GS-07, GS-08, GS-09, GS-10, GS-12, GS-15, GS-17, GS-19, GS-20, GS-28, GS-29, GS-30, GS-31 | • Ask for other people's data, earlier conversations and training material. • Search logs, traces and caches for personal data and secrets. • Check the supplier retention and training settings against the contract. | AS-05 (P24 AT-2): Data of a level or kind the person does not normally see appears in output, or in a log, trace or cache. AS-06 (P24 AT-1): Personal data or Confidential data found in a tool that is not approved for it, or leaving through an outbound request. | Yes | LF-3 | Chief Operating Officer (LF-3) | Not tested | |||
| EXAMPLE | LT-04 | Excessive agency | LLM03 Excessive Agency | OWASP Top 10 for LLM Applications 2026: LLM03:2026 Excessive Agency | AML.T0053 — AI Agent Tool Invocation AML.T0086 — Exfiltration via AI Agent Tool Invocation | A feature has more functions, more permission or more freedom than its task needs, so that a wrong or manipulated output causes damage. | A mailbox assistant that can send and delete mail follows an instruction in an inbound email and forwards the finance inbox to an outside address. | Unauthorised actions, loss of data, money or access, and damage the organisation cannot reverse. | GS-01, GS-06, GS-10, GS-19, GS-20, GS-21, GS-22, GS-23, GS-24, GS-25, GS-26, GS-27, GS-28, GS-29, GS-30, GS-31 | • List every tool, scope and identity, and try each tool outside the task. • Try to skip or pre-empt the approval step. • Try to make the feature release a payment or change a supplier's bank details. | AS-07 (P24 AT-6): A tool call outside the feature's normal pattern: a new recipient, a new system, a bulk read, a delete, or a call that follows a refusal. AS-08 (P24 AT-6): An action taken without the approval the standard requires, or an approval that shows a different action from the one done. | Yes | LF-3 | Chief Operating Officer (LF-3) | Not tested | |||
| EXAMPLE | LT-05 | AI supply chain compromise | LLM04 Supply Chain | OWASP Top 10 for LLM Applications 2026: LLM04:2026 Supply Chain | AML.T0010 — AI Supply Chain Compromise | A model, adapter, dataset, library, tool or connector the feature depends on has been tampered with, replaced or changed without notice. | A developer downloads a fine-tuned adapter from a public site and it carries a hidden behaviour. A provider switches the model version and answers change. | A hidden backdoor, changed behaviour, a loss of integrity in every answer, or code run on load. | GS-01, GS-15, GS-16, GS-17, GS-18, GS-28, GS-29, GS-30, GS-31 | • Check the publisher, source and file hash of every artefact. • Compare the feature's answers on a fixed question set before and after a model or version change. • Check that connectors are pinned and approved. | AS-09 (P24 AT-4): A new model version, tool, connector or tool description, or a changed file hash, that nobody approved. | Yes | LF-3 | Chief Operating Officer (LF-3) | Not tested | |||
| EXAMPLE | LT-06 | Data and model poisoning | LLM05 Data and Model Poisoning | OWASP Top 10 for LLM Applications 2026: LLM05:2026 Data and Model Poisoning | AML.T0020 — Training Data Poisoning | Data or model files are manipulated to embed bad behaviour: in pre-training, fine-tuning, an embedding set, a retrieval source or a distributed model. | A wiki that anyone in the company can edit feeds the internal assistant, and someone adds a page saying that supplier bank changes asked for by phone are pre-approved. | Wrong or harmful output that looks normal, a hidden trigger, and a defect that needs data clean-up or retraining to remove. | GS-01, GS-12, GS-13, GS-14, GS-15, GS-17, GS-19, GS-28, GS-29, GS-30, GS-31 | • Add marked test entries to a copy of each source and see whether the feature repeats them. • Trace the lineage of fine-tuning and retrieval data. • Run a fixed question set weekly and compare. | AS-10 (P24 AT-6): New documents from an unusual author in a knowledge store, a sudden change in what ranks first, or a fixed question set whose answers drift. | Yes | LF-3 | Chief Operating Officer (LF-3) | Not tested | |||
| EXAMPLE | LT-07 | Unbounded consumption | LLM06 Unbounded Consumption | OWASP Top 10 for LLM Applications 2026: LLM06:2026 Unbounded Consumption | AML.T0029 — Denial of AI Service AML.T0034 — Cost Harvesting | The feature allows excessive and uncontrolled use of the model, so that service is lost, cost runs away or the model is copied through its answers. | A public chatbot receives long prompts in a loop and uses its monthly token budget in a day. | Denial of service, an unexpected bill, and loss of intellectual property. | GS-01, GS-05, GS-20, GS-21, GS-26, GS-28, GS-29, GS-30, GS-31 | • Send long inputs and loops up to a safe test limit and see that the cap stops use. • Check the limits on steps and tool calls in one task. • Check that a warning is not the only control. | AS-11 (P24 AT-6): Tokens or cost per person or per hour well above the feature's pattern, or repeated maximum-length requests. | Yes | LF-3 | Chief Operating Officer (LF-3) | Not tested | |||
| EXAMPLE | LT-08 | Misinformation | LLM07 Misinformation | OWASP Top 10 for LLM Applications 2026: LLM07:2026 Misinformation | AML.T0062 — Discover LLM Hallucinations | The feature produces incorrect, incomplete or invented output that looks credible, and a person or a system acts on it. | An assistant invents a clause number in a supplier summary and a buyer relies on it. A coding assistant names a software package that does not exist. | Wrong decisions and actions, financial loss, and a supply chain trap where someone registers the invented name. | GS-01, GS-18, GS-20, GS-25, GS-27, GS-28, GS-29, GS-30, GS-31 | • Ask questions with known answers and questions with no answer. • Check that sources are shown and that the feature says when it does not know. • Check invented names of packages, functions and clauses. | AS-12 (P24 AT-5): A user or reviewer reports an invented fact, source, name or package that was relied on. | Yes | LF-3 | Chief Operating Officer (LF-3) | Not tested | |||
| EXAMPLE | LT-09 | Hidden context exposure (system prompt leakage) | LLM08 Hidden Context Exposure | OWASP Top 10 for LLM Applications 2026: LLM08:2026 Hidden Context Exposure (named System Prompt Leakage in the 2025 edition) | AML.T0056 — Extract LLM System Prompt AML.T0084 — Discover AI Agent Configuration | A user gets the model to reveal its hidden instructions, tool descriptions or retrieved policy text. | A user asks the assistant to repeat the text above and receives its instructions, including a key for the order system that a developer pasted in. | Credentials and rules exposed, and a map of the feature for further attacks. | GS-01, GS-02, GS-10, GS-11, GS-18, GS-20, GS-28, GS-29, GS-30, GS-31 | • Try to extract the system prompt and the tool list. • Search prompts and tool descriptions for secrets. • Confirm that revealing the whole prompt would give an attacker no access. | AS-01 (P24 AT-6): Output that quotes the system prompt or tool list, or many near-identical requests asking the model to repeat its instructions. | Yes | LF-3 | Chief Operating Officer (LF-3) | Not tested | |||
| EXAMPLE | LT-10 | Vector and embedding weaknesses | LLM09 Vector and Embedding Weaknesses | OWASP Top 10 for LLM Applications 2026: LLM09:2026 Vector and Embedding Weaknesses | AML.T0070 — RAG Poisoning AML.T0071 — False RAG Entry Injection | The retrieval layer returns content the person should not see, accepts poisoned content, or mixes content of different owners, because access control or provenance at the index is weak. | One index holds HR files and public handbooks under one access list, so a question from any employee retrieves HR passages. | Disclosure across teams or customers, and poisoned answers that persist in the index. | GS-01, GS-03, GS-08, GS-09, GS-12, GS-13, GS-19, GS-20, GS-23, GS-28, GS-29, GS-30, GS-31 | • Ask as people with different rights for documents they must not see. • Add a poisoned document to a test copy and see whether it ranks. • Try to retrieve across collections or tenants. | AS-05 (P24 AT-2): Data of a level or kind the person does not normally see appears in output, or in a log, trace or cache. AS-10 (P24 AT-6): New documents from an unusual author in a knowledge store, a sudden change in what ranks first, or a fixed question set whose answers drift. | LF-3: The chatbot has no vector store. | ||||||
| EXAMPLE | LT-11 | Improper output handling | LLM10 Improper Output Handling | OWASP Top 10 for LLM Applications 2026: LLM10:2026 Improper Output Handling | AML.T0077 — LLM Response Rendering | The model's output is passed to a page, query, shell, template or other component without checking, so that the output acts as code or as a request. | A feature that drafts web content shows model output as HTML, and an injected instruction adds an image link that sends the conversation to an outside server. | Cross-site scripting, injection into a database or system, data leaving through links, and code run on a back end. | GS-01, GS-03, GS-06, GS-07, GS-19, GS-20, GS-22, GS-28, GS-29, GS-30, GS-31 | • Make the model emit script, image links, query fragments, shell text and control characters. • Check that each receiving component encodes or rejects them. • Check that links and images do not load by themselves. | AS-04 (P24 AT-6): Output that contains addresses, images or encoded text that are not in the source and not asked for. AS-05 (P24 AT-2): Data of a level or kind the person does not normally see appears in output, or in a log, trace or cache. | Yes | LF-3 | Chief Operating Officer (LF-3) | Not tested | |||
| EXAMPLE | LT-12 | Poisoned memory and tool descriptions | LLM01 Prompt Injection | OWASP Top 10 for Agentic Applications 2026: ASI06 Memory & Context Poisoning | AML.T0080 — AI Agent Context Poisoning AML.T0084 — Discover AI Agent Configuration | An attacker plants instructions in an agent's persistent memory, or in the description of a tool or connector, so that later sessions carry them. The 2026 OWASP LLM list points to the agentic list (ASI06 Memory & Context Poisoning) for memory attacks. | A support ticket makes an agent save a note to copy attachments to an outside address, and the note is acted on in later sessions. A connector's description is changed after approval and carries hidden instructions. | A lasting compromise that survives the end of the session and spreads to every later use. | GS-01, GS-14, GS-16, GS-19, GS-20, GS-22, GS-26, GS-28, GS-29, GS-30, GS-31 | • Write a marked instruction into memory and see whether the next session follows it. • Read every tool description for instructions and change one after approval to see whether the change is noticed. • Check that memory writes are logged and can be cleared. | AS-03 (P24 AT-6): Output or a tool call that follows content the feature has just read, and that the person did not ask for. AS-09 (P24 AT-4): A new model version, tool, connector or tool description, or a changed file hash, that nobody approved. | Yes | LF-3 | Chief Operating Officer (LF-3) | Not tested |
Controls
Which requirement of the Generative AI Security Standard answers which threat. "Yes" is calculated from the catalogue's own Controls column. The words of each requirement are the Standard's.
| Direct prompt injection | Indirect prompt injection | Sensitive information disclosure | Excessive agency | AI supply chain compromise | Data and model poisoning | Unbounded consumption | Misinformation | Hidden context exposure (system prompt leakage) | Vector and embedding weaknesses | Improper output handling | Poisoned memory and tool descriptions | ||||
| ID | Area | Requirement | LT-01 | LT-02 | LT-03 | LT-04 | LT-05 | LT-06 | LT-07 | LT-08 | LT-09 | LT-10 | LT-11 | LT-12 | Threats it answers (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| GS-01 | Scope | Every LLM feature the organisation builds, configures or switches on is on the AI inventory (P24 A05) with a named owner before it goes live, and this standard applies to it. That includes a feature a supplier adds to software already in use. A feature the organisation builds on a supplier's model API (prompts, retrieval, tools or code around a model it calls) answers Yes to P24's building question, for staff as for customers (AG-17): a new feature is Tier 3 and held until Legal records the role, and it is reviewed at Depth 3 until then. If Legal records the deployer role, the tier is set again from the answers and the depth follows it; if Legal records the provider role or another role, the hold clears but the feature stays Tier 3 and stays at Depth 3. A feature already running carries the hold as a condition with a date and is reviewed at the depth its tier and properties give. A supplier's finished product used as supplied is not building. Which AI may be used and who approves it are P24's rules (AG-09). | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | 12 |
| GS-02 | Design | Design on the assumption that the model will be fooled. The security of the feature rests on what the system around the model allows, never on instructions in the prompt. A control that is only a sentence in a prompt is not a control. | Yes | Yes | Yes | 3 | |||||||||
| GS-03 | Design | Draw a data flow for each feature that shows every source the model reads (user input, files, web pages, email, tool results, retrieved text, memory) and every place its output goes (screens, files, databases, links, tools, other systems). Mark each source trusted or untrusted. Content from outside the organisation, and content from anyone who can submit text, is untrusted, whichever system holds it. | Yes | Yes | Yes | Yes | Yes | 5 | |||||||
| GS-04 | Input handling | Keep untrusted content apart from instructions: send it in a separate, labelled part of the request, and never build instructions by joining text from untrusted sources. Strip hidden characters (tag characters, zero-width characters and variation selectors) when content comes in and when output is shown. Filter every kind of input the feature takes, not only text. These steps lower the chance of success. They are not a barrier. | Yes | Yes | 2 | ||||||||||
| GS-05 | Input handling | Limit the size, number and type of inputs, files and tool results the model receives, and reject the rest. | Yes | Yes | 2 | ||||||||||
| GS-06 | Output handling | Treat the model's output as untrusted input to whatever receives it. Check it against a schema in application code, encode it for where it goes (page, query, shell, link, terminal), and never pass it to an interpreter, query or template without that. | Yes | Yes | Yes | 3 | |||||||||
| GS-07 | Output handling | A screen or message that shows model output does not fetch addresses the output names (images, link previews, frames) unless they are on an allow list, and shows the full address of any link. | Yes | Yes | Yes | 3 | |||||||||
| GS-08 | Data exposure | Send the model only what the task needs, at the lowest data level that works, and apply P24's data permissions at the point of sending (the data permission check of the approved tool list, P24 A07; P15 levels). Personal data goes in only as GDPR Article 25 asks: by design and by default, with the amount, the extent of processing, the storage period and the access limited to the purpose. | Yes | Yes | 2 | ||||||||||
| GS-09 | Data exposure | Retrieval and search tools return only what the signed-in person may already read. The check is made in the index query or the source system, with the person's identity. Asking the model to hold something back is not a check. | Yes | Yes | 2 | ||||||||||
| GS-10 | Secrets | No secret, password, key or token goes into a prompt, a system prompt, a tool description or a knowledge store. The application or a secrets store holds keys, one per feature and environment, rotated and recovered as P14 sets (PA-10). A key that appears in output or a log is revoked at once. | Yes | Yes | Yes | 3 | |||||||||
| GS-11 | Secrets | Treat the system prompt, the tool descriptions and any policy text retrieved for the model as readable by users. Nothing in them may give an attacker more access than they already have, and nothing in them is relied on as a security boundary. | Yes | 1 | |||||||||||
| GS-12 | Knowledge stores | Every knowledge store (index, vector store, cache, memory) has an owner, a list of its sources, a data level, access control that matches its sources, and a way to remove a document and everything derived from it. | Yes | Yes | Yes | 3 | |||||||||
| GS-13 | Knowledge stores | Content enters a knowledge store only from named sources, added by named people or processes, with a record of who added it and when. Content from untrusted sources is kept apart from trusted content and checked before it is trusted. | Yes | Yes | Yes | 3 | |||||||||
| GS-14 | Knowledge stores | Where a feature keeps memory between sessions, writes to memory are logged with their cause, are limited to what the task needs, and are kept per person. The person and the owner can view and clear them. Text that reads as an instruction is not stored as memory without approval. | Yes | Yes | Yes | 3 | |||||||||
| GS-15 | Model and provider | Choose a model and its provider through P24's tool approval (A07) and the supplier assessment of P06, and record the model name and version each feature uses. The provider answers the questionnaire (A06). A model or adapter taken from a public source is used only after its publisher, source and file hash are checked and it is loaded in a form that does not run code when loaded. | Yes | Yes | Yes | 3 | |||||||||
| GS-16 | Model and provider | Keep a list of the models, adapters, datasets, libraries, tools and connectors each feature uses, with versions, and manage them as the vulnerability and patch packs manage other software (P01, P17). Tool and connector servers are pinned to a version and approved before use. | Yes | Yes | 2 | ||||||||||
| GS-17 | Model and provider | The contract carries the AI terms ST-1 to ST-8 (P24) and the clauses P06 clause CL-04, P06 clause CL-05, P06 clause CL-06, P06 clause CL-07, P06 clause CL-13 and P06 clause CL-20, and the provider's answers to A06 are on file. | Yes | Yes | Yes | 3 | |||||||||
| GS-18 | Change control | A change of model, model version, system prompt, tool, retrieval source or filter setting is a change: it goes through the change control that applies to the system, the attack classes it could affect are tested again at the feature's review depth, and the change is recorded. A provider's change of model is a trigger for review within [[10]] working days of the notice (P24 ST-7; AG-10). | Yes | Yes | Yes | Yes | Yes | 5 | |||||||
| GS-19 | Logging | Log, for each request: who asked and when; the feature, model and version; the system prompt version; the sources retrieved; every tool call with its arguments and result; the output; and the verdict of each filter. Write the log to a store that the feature's administrators cannot change. Keep it for the period the owner records for the purpose, at least [[6]] months, and for a high-risk system at least 6 months where the Act applies (Article 26(6)). Limit who can read prompt logs and keep secrets out of them. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | 8 | ||||
| GS-20 | Monitoring | Monitor use for the signals AS-01 to AS-12. Alerts go to a named person, who looks at each within [[2]] working days. An event goes to the incident route (P09 IM-01). | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | 10 | ||
| GS-21 | Resource limits | Set limits per person and per feature on requests, tokens and the number of steps and tool calls in one task, and a hard spending cap per key and per feature that stops use when it is reached. A cap that only sends a warning is not a cap. | Yes | Yes | 2 | ||||||||||
| GS-22 | Agents and tools | Give the model only the tools the task needs. Each tool does one job and takes a strict input. Do not offer an open-ended tool (run any command, fetch any address) unless it runs in a sandbox with no network access to internal systems and no secrets. | Yes | Yes | Yes | 3 | |||||||||
| GS-23 | Agents and tools | A tool acts as the signed-in person, or under a named service identity with the least access its job needs (P14 PA-11; P13 JML-12). Credentials are held by the application, never the model, and the person's permission is checked on every call by code, not by the model. | Yes | Yes | 2 | ||||||||||
| GS-24 | Agents and tools | Count three properties of a feature: it reads untrusted content (A), it can reach sensitive data (B), and it can change state or communicate outside the organisation (C). With all three it needs a person to approve every action. With two the review records the residual risk. The review procedure (A03) counts them. | Yes | Yes | Yes | 3 | |||||||||
| GS-25 | Human approval | A person approves, seeing the exact action and not a summary of it, before any action that is irreversible, leaves the organisation, changes access, runs code outside a sandbox or affects a person. The agent permission checklist (A09) gives the answer for each kind of action. Spending is controlled through the cap on spend in the agent permission review (AP-13) and the hard spending cap (GS-21), and payments through the payment rule (GS-27), not through this approval. A decision about a person is made by a named person (P24 AG-06). | Yes | Yes | Yes | 3 | |||||||||
| GS-26 | Human approval | A feature that can act (send, change records, run commands or spend) has a switch-off that one named person can use in one step. It stops the feature, revokes its keys and tool access, and is tested before release and after any change to the feature (NIST AI RMF MANAGE 2.4). | Yes | Yes | Yes | 3 | |||||||||
| GS-27 | Human approval | No feature releases a payment or changes supplier bank details, by any tool or path (P24 AG-16). A feature may draft a payment request that a named person then makes through the normal approval. This requirement takes no exception (GS-30). | Yes | Yes | Yes | 3 | |||||||||
| GS-28 | Testing | Test each feature before release against the attack classes AC-01 to AC-12 at the depth the review procedure (A03) sets. At Depth 3 someone other than the builder tests (P20 CA-10). At Depth 2 the team tests, the review states who tested, and a tester who did not build the feature is expected. At Depth 1 no separate test is required. A feature already running when this standard is adopted is reviewed within [[90]] calendar days of adoption. Tests are repeated after a change that could affect an attack class. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | 12 |
| GS-29 | Evidence | The owner keeps for each feature the data flow, the threat selection, the standard check, the configuration checklist, the test results, the findings and exceptions, and the approval, while the feature runs and for [[3]] years after it ends, or longer where law or a contract asks. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | 12 |
| GS-30 | Findings | A finding is rated on P05's impact and likelihood scales, has an owner and a due date set by its severity, and is tracked in the register (A08). A departure from this standard is a P02 exception approved by the approver its band sets, and a Critical one goes to the board or its equivalent. A breach of P24's AG-03 or AG-05, and a feature that releases a payment (GS-27), take no exception. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | 12 |
| GS-31 | Review | This standard is reviewed at least every [[12]] months (P04 Standard tier), and when a new edition of the OWASP list or the MITRE ATLAS matrix is published, when an incident shows a gap, or when the law changes. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | 12 |
Coverage
Coverage: counts for each threat, and your entries
Calculated from the Threat Catalogue and the Controls sheet. The counts say how much is written against each threat and how much you have recorded. They are not a score and they are never added into one.
| ID | Threat | Requirements | Tests | Signals | ATLAS techniques | Applies to us | Test result |
|---|---|---|---|---|---|---|---|
| LT-01 | Direct prompt injection | 14 | 3 | 2 | 3 | Yes | Not tested |
| LT-02 | Indirect prompt injection | 17 | 3 | 2 | 2 | Yes | Partly tested |
| LT-03 | Sensitive information disclosure | 15 | 3 | 2 | 1 | Yes | Not tested |
| LT-04 | Excessive agency | 16 | 3 | 2 | 2 | Yes | Not tested |
| LT-05 | AI supply chain compromise | 9 | 3 | 1 | 1 | Yes | Not tested |
| LT-06 | Data and model poisoning | 11 | 3 | 1 | 1 | Yes | Not tested |
| LT-07 | Unbounded consumption | 9 | 3 | 1 | 2 | Yes | Not tested |
| LT-08 | Misinformation | 9 | 3 | 1 | 1 | Yes | Not tested |
| LT-09 | Hidden context exposure (system prompt leakage) | 10 | 3 | 1 | 2 | Yes | Not tested |
| LT-10 | Vector and embedding weaknesses | 13 | 3 | 2 | 2 | Not yet assessed | |
| LT-11 | Improper output handling | 11 | 3 | 2 | 1 | Yes | Not tested |
| LT-12 | Poisoned memory and tool descriptions | 11 | 3 | 2 | 2 | Yes | Not tested |
| All | 12 threats | 145 | 36 | 19 | 20 |
A requirement can answer several threats, so the Requirements total counts each pairing. The same holds for signals. Neither total is a measure of protection.
Your entries in the Threat Catalogue
11
10
11 of 12 threats are marked as applying to you; 1 are not yet assessed.
The requirements of the Generative AI Security Standard
31
31
5
The requirements are the Standard's. This sheet counts how they are spread across the threats. It does not say whether your features do what they ask.
Lists
| Applies | Result |
|---|---|
| Yes | Not tested |
| No | Partly tested |
| Not yet assessed | Tested: no finding |
Tested: finding raised
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Threat (LT-nn) | One way an LLM application can be attacked or can fail. LT-01 to LT-12 are the pack's stable IDs for them. |
| Requirement (GS-nn) | One requirement of the Generative AI Security Standard. The catalogue names the ones that answer each threat. |
| Detection signal (AS-nn) | An observation that suggests a threat is happening. It hands over to the incident route, which decides whether it is an incident. |
| Test | A check run against a feature to see whether the threat works. The AI Red Team Test Plan Template holds the attack classes and safety rules for testing. |
| LLM application | Software that sends text, files or other content to an LLM and uses what comes back. A chat assistant, a summariser built into an office suite, a customer chatbot and an agent are all LLM applications. The inventory (P24) lists them as uses; this pack calls the part that uses the model a feature. |
| Feature | One LLM capability the organisation uses, builds or has switched on, for one purpose, with one owner. A feature is the technical view of a P24 use. |
| Prompt injection | Content that changes what the model does, in a way its builder did not intend. It is direct when the user types it and indirect when the model reads it in a document, web page, email, tool result or retrieved passage. |
| Untrusted content | Any content the feature reads that came from outside the organisation or from a person who can submit text: customers' messages, supplier documents, inbound email, web pages, tickets, public files, and the output of a tool that fetches such things. |
| Agent | A feature in which the model chooses which tools to call and in what order, with tool results fed back to it. An agent can act, so P24 treats a system that acts as Tier 3 until assessed (AG-16). |
| Tool | A function the model can ask the application to run: search, read a file, send an email, run a query, run code. Also called a plugin, extension, skill or connector. A connector gives access to another system. |
| Retrieval | Fetching stored content, such as company documents, and adding it to the prompt so the model can use it. Often called retrieval-augmented generation. |
| Knowledge store | Where retrieved content and memory are kept: a search index, a vector store, a semantic cache or an agent's memory. An embedding is the numerical form of a piece of content that a vector store uses to find similar content. |
| Excessive agency | A feature that can do more than its task needs, with more functions, more permission or more freedom than the task needs, so that a wrong or manipulated output causes damage. |
| Red team | A planned, authorised attempt to make a feature fail the way an attacker would, by someone other than its builder, with the results reported. |
| Finding | A confirmed gap between a feature and this standard, found in a review, a configuration check, a test or an incident, rated on P05's scales. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: the distributor, as at 2026-09-30. Delete the EXAMPLE entries before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 8.26 — Application security requirements | The whole catalogue: the application security threats a feature is designed and tested against |
| ISO/IEC 42001:2023 | Clause 6.1.2 — AI risk assessment | The whole catalogue: an input to the organisation's threat selection and its AI risk work |
| ISO/IEC 42001:2023 | Annex A 5.2 — AI system impact assessment process | The whole catalogue: an input to the organisation's threat selection and its AI risk work |
| NIST CSF 2.0 | ID.RA-03 — “Internal and external threats to the organization are identified and recorded” | The whole catalogue: threats to an LLM feature identified and recorded |
| EU AI Act — Regulation (EU) 2024/1689 | Article 15(5) — high-risk systems “shall be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities”; the technical solutions for AI-specific vulnerabilities “shall include, where appropriate, measures to prevent, detect, respond to, resolve and control for attacks trying to manipulate the training data set (data poisoning), or pre-trained components used in training (model poisoning), inputs designed to cause the AI model to make a mistake (adversarial examples or model evasion), confidentiality attacks or model flaws” | LT-02, LT-05, LT-06, LT-10: the Act's list of AI-specific attacks, for high-risk systems, which includes data poisoning and confidentiality attacks. It binds providers |
| EU AI Act — Regulation (EU) 2024/1689 | Article 113, as amended — the Regulation applies from 2 August 2026, except that Chapters I and II (including Articles 4 and 5) apply from 2 February 2025, with Article 5(1) points (ba) and (bb) and Article 5(1a) and (1b) applying from 2 December 2026; Chapter III Section 4, Chapter V (general-purpose AI models), Chapter VII and Chapter XII and Article 78 apply from 2 August 2025, except Article 101; and Chapter III Sections 1, 2 and 3, except Article 6(5), apply from 2 December 2027 as regards systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 as regards those under Article 6(1) and Annex I. Article 50 is not listed in an exception and so applies from 2 August 2026 | The dates on which the Act applies, as amended |
| EU AI Act — Regulation (EU) 2026/1744 (Digital Omnibus on AI) | Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Official Journal, 24 July 2026); in force on the third day after publication (its Article 4), 27 July 2026. Its Article 1 amends Regulation (EU) 2024/1689 | The amendment to the Act, which sets the dates in Article 113 |
| OWASP Top 10 for LLM Applications 2026 | LLM01:2026 Prompt Injection — “LLMs make no architectural distinction between ‘instructions’ and ‘data’ (both are tokens on the same stream)”. The entry splits it into direct injection, from the user, and indirect injection, from content the model reads, such as a web page, document, email or tool response, and says “Defense is therefore architectural rather than interceptive”: design the system on the assumption that the instruction boundary will be bypassed, and limit what the model may do and what its output may reach | Threat Catalogue: LT-01, LT-02 |
| OWASP Top 10 for LLM Applications 2026 | LLM02:2026 Sensitive Information Disclosure — “exposes confidential, regulated, privileged, or proprietary data through a channel the data subject, controller, or system owner did not authorize”. The channel is not only the final answer: tool-call arguments, reasoning traces, retrieved chunks, logs, telemetry and embeddings are disclosure surfaces | Threat Catalogue: LT-03 |
| OWASP Top 10 for LLM Applications 2026 | LLM03:2026 Excessive Agency — “the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM”; its root causes are excessive functionality, excessive permissions and excessive autonomy. Its prevention list starts with minimising tools, tool functionality and tool permissions, executing tools in the user’s context, requiring user approval for high-impact actions and complete mediation in logic rather than by the model | Threat Catalogue: LT-04 |
| OWASP Top 10 for LLM Applications 2026 | LLM04:2026 Supply Chain — “LLM supply chains are susceptible to vulnerabilities that affect the integrity of training data, models, adapters, conversion pipelines, and deployment platforms”; third-party models, datasets and adapters can be manipulated through tampering, poisoning or malicious artifact replacement | Threat Catalogue: LT-05 |
| OWASP Top 10 for LLM Applications 2026 | LLM05:2026 Data and Model Poisoning — “a class of attacks and failures where an adversary (or unsafe process) manipulates data or model artifacts to embed harmful behavior, bias, or exploitable weaknesses”, at pre-training, fine-tuning, embedding, retrieval and distribution | Threat Catalogue: LT-06 |
| OWASP Top 10 for LLM Applications 2026 | LLM06:2026 Unbounded Consumption — “allows excessive and uncontrolled inferences, enabling attackers to disrupt service availability, inflict unsustainable financial costs, or steal intellectual property through model cloning”; the entry says request-rate limits alone are not enough and asks for token-aware limits and hard spending caps | Threat Catalogue: LT-07 |
| OWASP Top 10 for LLM Applications 2026 | LLM07:2026 Misinformation — an LLM or application “produces incorrect, incomplete, unsupported, or misleading information that appears credible enough to influence a human decision, an automated workflow, or an agent action”; the core risk is that the incorrect output is trusted and acted upon | Threat Catalogue: LT-08 |
| OWASP Top 10 for LLM Applications 2026 | LLM08:2026 Hidden Context Exposure (named System Prompt Leakage in the 2025 edition) — “unauthorized extraction, inference, or reconstruction of hidden, non-user-facing system instructions or operational context placed in a model’s context”; practitioners “should design under the assumption that hidden context is discoverable”, keep credentials out of it and not rely on it as a security boundary | Threat Catalogue: LT-09 |
| OWASP Top 10 for LLM Applications 2026 | LLM09:2026 Vector and Embedding Weaknesses — risks in any application that converts content into numerical representations and “uses similarity search to decide what the model sees”, including retrieval-augmented generation, agent memory and semantic caches; its controls start with permission and access control on the index | Threat Catalogue: LT-10 |
| OWASP Top 10 for LLM Applications 2026 | LLM10:2026 Improper Output Handling — “insufficient validation, sanitization, and handling of the outputs generated by large language models before they are passed downstream to other components and systems”; the first control is to treat the model as any other user, with a zero-trust approach to its responses | Threat Catalogue: LT-11 |
| OWASP Top 10 for Agentic Applications 2026 | ASI02 Tool Misuse & Exploitation — the 2026 LLM list says that, in agentic systems, Excessive Agency “can manifest as ASI02: Tool Misuse & Exploitation, ASI03: Identity & Privilege Abuse and ASI08: Cascading Failures”. The agentic document itself was not read | LT-04: the agent list's entry that the 2026 LLM list names as one way Excessive Agency shows up |
| OWASP Top 10 for Agentic Applications 2026 | ASI03 Identity & Privilege Abuse — named in the 2026 LLM list, with ASI02 and ASI08, as a way Excessive Agency shows up in agentic systems. The agentic document itself was not read | LT-04: the agent list's entry that the 2026 LLM list names as one way Excessive Agency shows up |
| OWASP Top 10 for Agentic Applications 2026 | ASI06 Memory & Context Poisoning — the 2026 LLM list points to it (as “ASI06:2026 Memory and Context Poisoning”) for “agent-memory attacks that do not rely on embedding geometry”. The agentic document itself was not read | Threat Catalogue: LT-12 |
| MITRE ATLAS 2026.09 | AML.T0051.000 — LLM Prompt Injection: Direct | Threat Catalogue: LT-01 |
| MITRE ATLAS 2026.09 | AML.T0051.001 — LLM Prompt Injection: Indirect | Threat Catalogue: LT-02 |
| MITRE ATLAS 2026.09 | AML.T0054 — LLM Jailbreak | Threat Catalogue: LT-01 |
| MITRE ATLAS 2026.09 | AML.T0010 — AI Supply Chain Compromise | Threat Catalogue: LT-05 |
| MITRE ATLAS 2026.09 | AML.T0020 — Training Data Poisoning | Threat Catalogue: LT-06 |
| MITRE ATLAS 2026.09 | AML.T0070 — RAG Poisoning | Threat Catalogue: LT-10 |
| MITRE ATLAS 2026.09 | AML.T0071 — False RAG Entry Injection | Threat Catalogue: LT-10 |
| MITRE ATLAS 2026.09 | AML.T0056 — Extract LLM System Prompt | Threat Catalogue: LT-09 |
| MITRE ATLAS 2026.09 | AML.T0057 — LLM Data Leakage | Threat Catalogue: LT-03 |
| MITRE ATLAS 2026.09 | AML.T0053 — AI Agent Tool Invocation | Threat Catalogue: LT-04 |
| MITRE ATLAS 2026.09 | AML.T0086 — Exfiltration via AI Agent Tool Invocation | Threat Catalogue: LT-04 |
| MITRE ATLAS 2026.09 | AML.T0029 — Denial of AI Service | Threat Catalogue: LT-07 |
| MITRE ATLAS 2026.09 | AML.T0034 — Cost Harvesting | Threat Catalogue: LT-07 |
| MITRE ATLAS 2026.09 | AML.T0062 — Discover LLM Hallucinations | Threat Catalogue: LT-08 |
| MITRE ATLAS 2026.09 | AML.T0077 — LLM Response Rendering | Threat Catalogue: LT-11 |
| MITRE ATLAS 2026.09 | AML.T0080 — AI Agent Context Poisoning | Threat Catalogue: LT-12 |
| MITRE ATLAS 2026.09 | AML.T0068 — LLM Prompt Obfuscation | Threat Catalogue: LT-01, LT-02 |
| MITRE ATLAS 2026.09 | AML.T0084 — Discover AI Agent Configuration | Threat Catalogue: LT-09, LT-12 |
| NIST AI 600-1 | NIST AI 600-1, section 2.9 Information Security — generative AI “expands the available attack surface, as GAI itself is vulnerable to attacks like prompt injection or data poisoning”; “Indirect prompt injection attacks occur when adversaries remotely (i.e., without a direct interface) exploit LLM-integrated applications by injecting prompts into data likely to be retrieved”; and information security for these systems includes “maintaining availability of the GAI system and the integrity and (when applicable) the confidentiality of the GAI code, training data, and model weights” | LT-01, LT-02, LT-06: NIST's account of prompt injection and data poisoning as information security risks |
| NIST AI 600-1 | NIST AI 600-1, section 2.12 Value Chain and Component Integration — “GAI value chains involve many third-party components such as procured datasets, pre-trained models, and software libraries”, which “might be improperly obtained or not properly vetted”, and it may be difficult to attribute an issue to any one source | LT-05: NIST's account of third-party components in the generative AI value chain |
| Guidelines for secure AI system development (NCSC, CISA and partners) | Secure design, “Model the threats to your system” — “you apply a holistic process to assess the threats to your system, which includes understanding the potential impacts to the system, users, organisations, and wider society if an AI component is compromised or behaves unexpectedly”, and document the decision making | The whole catalogue: modelling the threats to a system, and documenting the decisions |
Editions referenced: Regulation (EU) 2024/1689 (the EU AI Act) as amended by Regulation (EU) 2026/1744; Regulation (EU) 2016/679 (GDPR); OWASP Top 10 for LLM Applications, 2026 edition; MITRE ATLAS 2026.09; NIST AI 600-1; NIST AI RMF 1.0; NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024; ISO/IEC 42001:2023 (by number and title only); as published and read on 8 October 2026
ISO/IEC 27001 and ISO/IEC 42001 references name the clause or control this document relates to, by number and title only. ISO/IEC 42001 is a paid standard whose text was not read for this document. A reference does not say that meeting a clause or control meets any requirement of the EU AI Act or the GDPR.
This pack does not say which OWASP, MITRE ATLAS, NIST or ISO/IEC 42001 items meet a requirement of the EU AI Act or the GDPR. Each reference says what its source asks for and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.