Learn · AI Security Crosswalk

Map your AI build to the major AI-security frameworks

Pick a risk in your stack, whether it lives in the input, output, model, infrastructure, or agentic layer, and see which controls apply across OWASP, MITRE, and the major compliance frameworks. These are the same risks Nemesis tests for.

OWASP LLM Top 10MITRE ATLASMITRE ATT&CKOWASP API Top 10OWASP Web Top 10NIST AI RMFISO 42001EU AI ActNIST 800-53SOC 2HIPAAHITRUST CSFNIST AI 600-1

The five layers of AI security. Input covers what reaches the model, including prompts, RAG context, and files. Output covers what the model returns and how it gets handled downstream. Model covers the model itself along with its training and embedding data. Infrastructure covers the API, keys, hosting, and rate limits around it. Agentic covers the tools, autonomy, and multi-step actions an agent can take.

16 risks
Input
Prompt Injection
Crafted input overrides the model’s instructions, either directly or through poisoned content it reads from RAG, files, or the web.
LLM01:2025
Input
Vector & Embedding Weaknesses
RAG retrieval and embedding stores get manipulated or leak data, through poisoned documents, embedding inversion, or cross-tenant retrieval.
LLM08:2025
Output
Sensitive Information Disclosure
The model reveals secrets, PII, or proprietary data in its responses, whether from training data, system context, or other users’ data.
LLM02:2025
Output
Improper Output Handling
Model output is consumed by downstream systems without validation, which can lead to XSS, SSRF, or remote code execution.
LLM05:2025
Output
Misinformation
The model produces confidently wrong or fabricated output that users over-trust, leading to harmful decisions.
LLM09:2025
Model
Data & Model Poisoning
Training, fine-tuning, or embedding data is tampered with to implant backdoors, bias, or degraded behavior.
LLM04:2025
Model
System Prompt Leakage
The system prompt, which holds rules, secrets, or architecture details, gets extracted through crafted questions.
LLM07:2025
Model
Model Theft & Extraction
Unauthorized access to or replication of a proprietary model through query-based extraction or direct exfiltration.
MODEL-THEFT
Infrastructure
Unbounded Consumption
Uncontrolled token, compute, or API consumption, including token floods, recursive expansion, runaway cost, and denial of wallet.
LLM10:2025
Infrastructure
Supply Chain
Compromised models, datasets, libraries, or plugins introduce vulnerabilities into the AI pipeline.
LLM03:2025
Infrastructure
API Authentication & Access
The endpoint serving the model lacks auth, leaks keys, or allows unauthenticated access, which is the classic API attack surface.
API-AUTH
Infrastructure
Security Misconfiguration
Missing security headers, wildcard CORS, verbose errors, exposed files, or no HTTPS enforcement on the AI service.
API-MISCONFIG
Agentic
Excessive Agency
An agent has too much autonomy, permission, or tool access, letting manipulation translate into real-world actions.
LLM06:2025
Agentic
Agentic Tool & Chain Abuse
Multi-step agents get hijacked through tool outputs, memory poisoning, or chained calls that compound a single injection.
AGENT-CHAIN
Agentic
Insufficient Human Oversight
No human in the loop or audit trail on high-impact agent actions, so failures and manipulations go unchecked.
AGENT-OVERSIGHT
Agentic
MCP & Connector Tool Abuse
Untrusted or over-permissioned tool servers (for example MCP servers and third-party connectors) feed poisoned tool output, hijack tool calls, or hand an agent capabilities it should not have. Documented in real autonomous-attack tradecraft where penetration tools were wired in as MCP servers to turn an agent into an attack platform.
MCP-TOOL-ABUSE
Control IDs are drawn from published framework catalogs, including the OWASP LLM Top 10 (2025), MITRE ATLAS, MITRE ATT&CK, OWASP API and Web Top 10, NIST AI RMF, ISO 42001, EU AI Act, NIST 800-53, SOC 2, HIPAA, HITRUST CSF, and the NIST AI 600-1 Generative AI Profile. This is a reference crosswalk, so verify mappings against each framework's source before formal compliance use.