Standards & References

A links-only page. These are the primary sources behind everything else on this site: when a claim here disagrees with one of these documents, the document wins.

Two habits are worth building. First, read the source rather than a summary of it, at least once per framework, because the summaries drop exactly the nuance that matters in a review. Second, cite by name in conversation. Saying “this maps to ATLAS reconnaissance techniques” is a different signal than saying “attackers probe first.”

Agentic and LLM application security

• OWASP Top 10 for Large Language Model Applications (OWASP GenAI Security Project) — https://genai.owasp.org — The reference list of LLM application risk categories. Useful as the shared vocabulary in any design review; most teams have at least heard of it, which makes it a good entry point for a conversation about controls.
• OWASP GenAI Security Project (OWASP Foundation) — https://owasp.org/www-project-top-10-for-large-language-model-applications/ — The umbrella project page, which links to the current release, the agentic security work, and the associated guidance documents. Navigate from here rather than bookmarking a specific PDF, since releases are versioned and superseded.
• OWASP agentic AI threats and mitigations guidance (OWASP GenAI Security Project) — https://genai.owasp.org — Published under the GenAI Security Project, this line of work covers threats specific to autonomous and multi-agent systems: goal manipulation, tool misuse, agent-to-agent trust, memory poisoning. This is the closest thing to a canonical agentic taxonomy; find it via the project’s initiatives or publications section.
• OWASP Application Security Verification Standard (ASVS) (OWASP Foundation) — https://owasp.org/www-project-application-security-verification-standard/ — The classical web application security baseline, as a list of verifiable requirements. Useful because most real agent incidents still bottom out in ordinary application security failures, and ASVS is how you show that the baseline was covered before anyone talks about model-specific controls.

Adversarial ML knowledge bases

• MITRE ATLAS (MITRE) — https://atlas.mitre.org — Adversarial Threat Landscape for Artificial-Intelligence Systems: a knowledge base of real-world tactics and techniques against AI-enabled systems, with case studies. Useful for mapping a red team finding to a named technique so defenders can act on it.
• MITRE ATT&CK (MITRE) — https://attack.mitre.org — The parent model ATLAS is structured after, covering adversary tactics and techniques against enterprise, cloud, mobile, and ICS. Useful because an agent compromise almost always continues into ordinary post-exploitation, and ATT&CK is where that half of the story is documented.

Risk management and governance

• NIST AI Risk Management Framework (AI RMF 1.0) (NIST) — https://www.nist.gov/itl/ai-risk-management-framework — A voluntary framework organized around four functions: Govern, Map, Measure, Manage. Useful as the structure for an AI risk program when a regulator or customer asks how you decide what to assess.
• NIST Generative AI Profile (NIST) — https://www.nist.gov/itl/ai-risk-management-framework — A companion profile to the AI RMF addressing risks specific to generative AI, published as part of the AI RMF resource set on the page above. Useful for translating generic risk language into concrete generative-AI actions.
• NIST Secure Software Development Framework (SSDF, SP 800-218) (NIST) — https://csrc.nist.gov/projects/ssdf — Secure development practices organized as outcomes rather than tools, with a companion addressing generative AI and dual-use foundation models. Useful for supply chain and build-integrity requirements around AI systems.
• ISO/IEC 42001 (ISO/IEC) — https://www.iso.org/standard/81230.html — The management system standard for artificial intelligence, structured like ISO/IEC 27001 but scoped to AI. Useful when an organization wants a certifiable AI governance program rather than a framework it self-assesses against.
• ISO/IEC 23894 (ISO/IEC) — https://www.iso.org/standard/77304.html — Guidance on AI risk management, aligned with the ISO 31000 risk vocabulary. Useful for organizations that already run an ISO-style risk process and need AI to fit inside it.
• ISO/IEC 27001 (ISO/IEC) — https://www.iso.org/standard/27001 — The information security management system standard. Useful as the control baseline that AI-specific standards assume is already in place; auditors will ask how 42001 relates to your existing 27001 scope.

Regulation

• Regulation (EU) 2024/1689, the EU Artificial Intelligence Act (European Union) — https://eur-lex.europa.eu — The official consolidated legal text is published on EUR-Lex; search there for the AI Act by its regulation number to reach the authoritative multilingual version. Useful whenever the precise wording of a risk classification or obligation matters, which in a compliance argument is always.
• European Commission AI Act pages (European Commission) — https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai — The Commission’s own explanatory material, implementation timeline, and links to guidance and codes of practice. Useful for tracking what obligations apply from which date, which changes more often than the text itself.

Protocols and specs

• Model Context Protocol specification (Anthropic and the MCP community) — https://modelcontextprotocol.io — The specification, documentation, and reference implementations for the protocol that standardizes tool and resource exposure to models. Useful because the spec’s transport, capability, and consent language is what your MCP threat model must reason about.
• OpenTelemetry semantic conventions (OpenTelemetry / CNCF) — https://opentelemetry.io/docs/specs/semconv/ — The agreed attribute and span names for telemetry, including the developing conventions for generative AI and agent systems. Useful because agreeing on names is what makes agent telemetry queryable across teams and vendors.

Communities and events

• OWASP GenAI Security Project (OWASP Foundation) — https://genai.owasp.org — An open working group producing the LLM and agentic security guidance above. Useful as a way in: the work is public, contributions are welcome, and contributing is a credible portfolio item.
• DEF CON AI Village (AI Village) — https://aivillage.org — A community running AI security talks, workshops, and public red-teaming events at DEF CON and elsewhere. Useful for seeing what practitioners are actually finding, well before it reaches a standard.
• Security BSides (BSides community) — https://bsides.org — A global network of independent, community-organized security conferences. Useful as a realistic first speaking venue: the call-for-papers bar is approachable and the audience is exactly the one you want.

Korea-specific

• Korea Internet & Security Agency (KISA) (KISA) — https://www.kisa.or.kr — The national agency responsible for internet and information security in Korea. It publishes security guidance, including material on AI system security, along with certification and incident response programs. Useful for aligning an AI security program with Korean domestic expectations; navigate from the main site to the current guidance and publications sections, since document links change.
• Personal Information Protection Commission (PIPC) (PIPC, Republic of Korea) — https://www.pipc.go.kr — The independent regulator for personal data protection under Korea’s Personal Information Protection Act. It has issued guidance on processing personal data in AI development and services. Useful whenever an agent touches Korean personal data, particularly around training data, automated decisions, and the lawful basis for processing. Find the current guidance through the commission’s own publications listing rather than a third-party copy.

How to use these

Do not read them front to back. Pick the one that answers the question in front of you: the threat landscape section uses the OWASP and ATLAS material, the governance section uses NIST, ISO, and the AI Act, and the 90-day plan sequences the reading against practical work. The tooling that implements these expectations is on the observability page and the red team page. Back to the tools index.