Application and infrastructure security
OWASP ASVS for application security requirements, OWASP MASVS and MASTG for mobile apps, CIS Benchmarks for configuration hardening, the NIST Cybersecurity Framework 2.0, and CVSS v4.0 for severity scoring.
AI and security reference material
Understand AI risks and security standards — free to read.
Read the AI risk list we test against, a guide to whether your AI needs better prompts, access to your documents (RAG) or extra training (fine-tuning), and the standards behind our reports, all on one page.
- No gated PDFs, no email wall
- Jargon explained in plain English
- We reply within one working day.
- OWASP LLM Top 10 (2026)
- MITRE ATLAS
- NIST AI RMF
- OWASP ASVS
- ISO/IEC 27001
In brief
- What it is
- Reference material we use on real engagements: the standards we work to, the checklists we work through, and the questions we get asked before a project starts.
- Why it matters
- Shared terms save time. When you, your auditor and your supplier name a risk or a standard the same way, nobody has to translate a report before acting on it.
- What you get
- Three references you can use straight away: the top ten risks in apps built on large language models (LLMs), a guide to building with them, and the standards our reports cite. Nothing to sign up for.
Quick reference: AI security
The OWASP Top 10 for LLM Applications, 2026 edition.
The OWASP project's list of the ten main risks in applications built on large language models. It is the risk vocabulary our LLM security testing works from. Here is what each entry means in practice.
| Entry | What it means in practice |
|---|---|
| LLM01 Prompt injection | Untrusted text reaches the model as instructions. The version that actually catches teams out is indirect injection, where the instructions arrive inside a document or web page the model retrieves. |
| LLM02 Sensitive information disclosure | The model returns data the current user should not see. In RAG systems, where the model answers from documents it looks up, this is usually a retrieval permissions problem, not a model problem. |
| LLM03 Excessive agency | An AI agent, a model that can call tools and take actions, holds more permissions, tools or autonomy than the task needs. |
| LLM04 Supply chain | Third-party models, adapters and datasets pulled straight from a public hub, with no check on where they came from. |
| LLM05 Data and model poisoning | Tainted training or fine-tuning data. It also covers a vector store, the index a RAG system searches, that anyone can write into. |
| LLM06 Unbounded consumption | No limit on tokens (the chunks of text a model reads and writes, and what hosted models charge by), no rate limit, no cost alarm. It is cheap for an attacker to abuse, and it shows up on your invoice, not your dashboard. |
| LLM07 Misinformation | Confident wrong answers in a workflow that has no human check. A safety and liability issue more than a technical one. |
| LLM08 Hidden context exposure | Everything assembled into the model's context that the user never typed: the system prompt (your hidden instructions to the model), retrieved policy text, and the schemas that describe the tools it can call. The 2026 edition widened this from system prompt leakage, and tells you to design on the assumption that all of it is discoverable. |
| LLM09 Vector and embedding weaknesses | Cross-tenant retrieval, where one customer's search returns another customer's documents; embedding inversion, where source text is rebuilt from its stored vectors; and indexes that ignore the permissions of the source document. |
| LLM10 Improper output handling | Model output passed to a browser, shell or database without being treated as untrusted. This is where LLM bugs turn into ordinary web bugs such as cross-site scripting (XSS) and SQL injection. |
Always quote the edition year. The 2026 edition renumbers seven of the ten entries and renames one. OWASP's own Top 10 landing page still serves the 2025 list, so an LLM number quoted with no edition year has been ambiguous since August 2026. The full project text is on owasp.org.
Decision guide
Prompting, RAG or fine-tuning: start with the prompt.
Fine-tuning is rarely the right starting point. Begin with the first row. What comes next depends on the kind of failure you see, not on the row’s place in the list, as our LLM development page sets out.
| Approach | Use it when | Watch out for |
|---|---|---|
| Prompt engineering | The knowledge is already in the model and you need it shaped, formatted or constrained. | Prompts drift as models update. Pin versions and keep regression tests that catch a change for the worse. |
| RAG | Answers depend on your own documents, or on data that changes faster than you could retrain. | How documents are split (chunking), how results are ranked, and who may see what decide whether it works. |
| Fine-tuning | You need a consistent format, tone or classification behavior that prompting can't hold reliably. | It teaches behavior, not facts. Fine-tuning to add knowledge is the most expensive way to get a confident wrong answer. |
| Agents and tools | The task needs several steps, or actions in systems the model can't reach through text alone. | Every tool you grant widens the damage a mistake can do. Start read-only. Add write access once you can audit it. |
More on each: choosing between them, RAG development and AI agent development.
What we work to
Standards and frameworks behind our reports.
Every report we issue names the method it followed, so you can hand it to an auditor or a customer without translating it first. These are the documents behind that.
AI and machine learning
The OWASP Top 10 for LLM Applications, 2026 edition, as the risk vocabulary; the MITRE ATLAS adversarial technique matrix; the NIST AI Risk Management Framework (AI 100-1) and NIST AI 600-1, its generative AI profile; and the EU AI Act, for teams selling into the EU.
Governance and risk
ISO/IEC 27001 and 27002, ISO/IEC 42001 for AI management systems, the SOC 2 Trust Services Criteria, ISO 31000 and NIST RMF, plus India's DPDP Act, GDPR, HIPAA and PCI-DSS.
See how we apply them in defensive cybersecurity, AI security and GRC and compliance.
Also on this site
Things that will save you a call.
Start with the question you have. Each answer is already on the site.
- What would our project roughly cost? Answer a few questions and see a budget range, even if you never send it to us.Cost calculator
- How long does a project take, what does an assessment actually cover, and how is the work scoped and priced?Questions we get most
- Which technologies do you build and secure with?Technologies
- Where do you work from, and how do you work with clients in other regions?Locations
- What have you built and secured for other clients?Case studies
- Found a security issue on our own site? Read our disclosure terms, and what we commit to in return.Responsible disclosure
On the article archive. We would rather publish nothing than publish filler. Written pieces go up here when an engagement produces something worth writing down, and each one carries a named author. If there is a topic you want covered, tell us and we will move it up the list.
Let's talk
Have a question this page doesn't answer?
Tell us the risk, standard or build decision you're working through. We'll say which of our services fits, if any. We reply within one working day.