OWASP LLM Top 10
Every finding carries an OWASP LLM Top 10 identifier, so results line up with the framework your organisation already reports against.
The categories
| ID | Category | Covered by |
|---|---|---|
LLM01 | Prompt Injection | R-01, R-02, R-03; most TEST attack categories |
LLM02 | Sensitive Information Disclosure | R-06 |
LLM03 | Supply Chain | VALIDATE: retrieval integrity |
LLM04 | Data Poisoning | R-08; VALIDATE: context isolation |
LLM05 | Improper Output Handling | R-07; VALIDATE: output validation; TEST: output escape |
LLM06 | Excessive Agency | R-04, R-05; VALIDATE: access control; RUNTIME: capability enforcement |
LLM07 | Prompt Leakage | TEST: system-prompt extraction |
LLM08 | Vector and Embedding Weaknesses | VALIDATE: RAG analysis |
LLM09 | Misinformation | R-09; RUNTIME: behavioural fingerprinting |
LLM10 | Unbounded Consumption | VALIDATE: context length bounds |
Coverage by phase
No single phase covers the whole list, which is the point of having four. BUILD reaches what is visible in source; TEST reaches what is demonstrable against a live system; VALIDATE reaches deployment architecture; RUNTIME reaches what only shows up in production behaviour.
| Phase | Primary categories |
|---|---|
| BUILD | LLM01, LLM02, LLM04, LLM05, LLM06, LLM09 |
| TEST | LLM01, LLM05, LLM07 |
| VALIDATE | LLM03, LLM05, LLM06, LLM08, LLM10 |
| RUNTIME | LLM06, LLM09 |
Running one phase is not full coverage
A clean BUILD scan means your source contains no detectable weakness. It says nothing about whether an attack succeeds against the deployed system, which is what TEST measures. Reports state which phases ran precisely so a clean result is not read as broader than it is.
Using the mapping
Filter dashboard findings by OWASP category when you need a framework view, such as “where are we on prompt injection?”. Reports carry the same breakdown, and the Compliance section maps posture against the list.
If your organisation reports under NIST AI RMF, ISO 42001, or an internal control set, use the OWASP identifier as a bridge. Most AI control mappings are already expressed against it.
Further reading
The authoritative list is maintained by OWASP at genai.owasp.org. SecureAI tracks it; the ruleset version and hash printed on every report record exactly which revision produced a given result.
Related: Scan rules · Scores & exit codes