OWASP AI Exchange
Cross-industry reference for AI and ML security, privacy and governance controls
Reference page
The threat matrix and control categories of the OWASP AI Exchange, checked against owaspai.org on 30 October 2026. Each threat and control opens its page on owaspai.org in a new tab. The ATLAS techniques next to a threat are the ones its Exchange page cites, and open on this site; nothing else here is linked to techniques or CVEs, because the Exchange has no data feed.
Three attacker goals
- Disclose (Confidentiality)Train/test data, model IP (parameters and the process behind them), input or augmentation data, and non-AI assets.
- Deceive (Integrity)Model behaviour manipulated into unwanted output or actions.
- Disrupt (Availability)Model availability, and non-AI assets around the model.
Threats — by impact and attack surface
The Exchange's AI security matrix: each threat by the asset and impact it hits and the attack surface it uses, with the ATLAS techniques its Exchange page cites.
Model behaviour integrity
Deceive- Runtime — Input attack
- Runtime — Input attack
- Runtime — Input attack
- Runtime — Break into deployed model
- Runtime — Break into augmentation data
- Development — Engineering env
- Development — Engineering env
- Development — Supply chain
- Development — Supply chain
Augmentation data confidentiality
Disclose- Runtime — Input attack
- Runtime — Break into deployed system
Training data confidentiality
Disclose- Runtime — Input attack
- Runtime — Input attack
- Development — Engineering env
Model confidentiality
Disclose- Runtime — Input attack
- Runtime — Break into deployed model
- Development — Engineering env
Model behaviour availability
Disrupt- Runtime — Input attack
Model input data confidentiality
Disclose- Runtime — All IT
Any asset — CIA
Disrupt / Disclose- Runtime — All IT
- Runtime — All IT
- Runtime — All IT
Threats outside the matrix
- Agent message structure manipulationInput threat (agentic)
- Agent escapeRuntime threat (agentic)
- Source code / configuration leakDevelopment-time threat
Controls — 4 categories
Manage
Governance, risk and compliance
Supply chain management
Conventional security — managing security
Conventional security — development-time
Conventional security — runtime
Have resilient models
Watch
Limit
Minimize or obfuscate sensitive data
Standards and frameworks
| Framework | Status | Note |
|---|---|---|
| ISO/IEC 27090 (AI security) | published | Guidance standard, published 14 October 2026; no certification. The Exchange contributed about 70 pages. |
| ISO/IEC 27091 (AI privacy) | in development | Expected in 2027. The Exchange contributes. |
| prEN 18282 (EU AI Act cybersecurity) | in development | Draft harmonised standard from CEN/CENELEC JTC 21, with about 70 pages from the Exchange. Expected early 2027; it gives presumption of conformity for high-risk AI systems only once cited in the Official Journal. |
| ISO/IEC 5338 (AI lifecycle) | aligned | The Exchange points to 5338 for extending software lifecycle practice to AI (#DEV PROGRAM). The Exchange founder is the lead author of 5338. |
| MITRE ATLAS | partial | The Exchange cites 22 ATLAS mitigations and 11 ATLAS techniques (15 counting sub-techniques) in its text. The 13 technique IDs cited on threat pages are shown next to each threat above; 2 cited only on control pages are not. A full mapping is on the Exchange roadmap. |
| NIST (AI 100-2, AI RMF) | partial | Threat pages cite NIST AI 100-2, the adversarial machine learning taxonomy; the AI RMF is listed as a reference. A full NIST mapping is on the Exchange roadmap. |
| MITRE ATT&CK / CWE | No per-threat mapping. |