This overview is intended for both those new to AI risk and cybersecurity professionals seeking a high-level yet actionable summary.
Artificial intelligence is moving from experimentation into production faster than most governance programs were designed to accommodate.
What began as employees testing generative AI tools is becoming something far more consequential: models connected to enterprise data, applications, identities, APIs, workflows, and increasingly, autonomous agents capable of taking action on behalf of users.
That changes the risk conversation. The question is no longer simply, “Can employees use generative AI safely?”
It is increasingly: What happens when AI becomes part of the enterprise architecture itself?
That is where the OWASP Top 10 for LLM and Generative AI Applications becomes especially useful. It provides more than a list of technical vulnerabilities. Taken together, these risks illustrate how AI is expanding familiar concerns around identity, data protection, software supply chains, application security, third-party risk, availability, and decision-making.
And that creates a broader governance challenge.
Organizations must adopt AI quickly enough to stay competitive while maintaining enough visibility, control, and accountability to understand what they are introducing into the environment.
That balance is becoming one of the defining risk-management problems of enterprise AI.
AI Risk Is Enterprise Risk: What the OWASP Top 10 for LLMs Tells Us About Governance
The rapid adoption of generative AI has created an interesting challenge for cybersecurity and risk leaders.
The technology is evolving faster than most organizations can write policy around it.
That does not mean governance should wait.
OWASP’s 2025 Top 10 Risks for LLM and Generative AI Applications provides a useful way to understand the problem because the risks extend well beyond the model itself. They touch identity, data protection, software supply chains, application security, third-party risk, availability, financial exposure, and ultimately enterprise decision-making.
The current Top 10 includes (and for those less familiar, these are not just “AI problems” but amplifications of longstanding security issues):
LLM01 – Prompt Injection
Inputs can intentionally or unintentionally manipulate model behavior, including through external documents, websites, images, and other content. In systems connected to enterprise data or tools, the impact can move quickly from an inaccurate response to unauthorized access or actions. OWASP specifically emphasizes least privilege, trust boundaries, output validation, adversarial testing, and human approval for high-risk actions.
LLM02 – Sensitive Information Disclosure
AI systems can expose PII, financial information, proprietary business data, credentials, legal information, or other sensitive content if data access, sanitization, retention, and disclosure controls are poorly designed. This is fundamentally a data-governance problem as much as an AI problem.
LLM03 – Supply Chain
Enterprise AI increasingly depends on external models, datasets, libraries, platforms, adapters, and service providers. OWASP highlights risks involving vulnerable or outdated components, model provenance, licensing, third-party models, and tampered development artifacts. Traditional third-party risk management must therefore expand to account for the AI supply chain itself.
LLM04 – Data and Model Poisoning
Manipulated pre-training, fine-tuning, or embedding data can introduce bias, backdoors, degraded performance, or intentionally harmful behavior. The integrity of the data feeding an AI system becomes part of the system’s integrity.
LLM05 – Improper Output Handling
An LLM response should never automatically be treated as trusted input. Improperly validated output passed into applications, browsers, APIs, databases, or operating-system functions can create traditional vulnerabilities such as injection, privilege escalation, or remote-code execution.
LLM06 – Excessive Agency
This risk grows as organizations move from chatbots to agents. The more functions, permissions, and autonomy an AI system receives, the greater its potential impact when something goes wrong. OWASP identifies excessive functionality, excessive permissions, and excessive autonomy as central causes.
LLM07 – System Prompt Leakage
Don’t treat a system prompt as a secret or a security boundary. Credentials, connection strings, authorization logic, or other sensitive information should never depend on the assumption that a prompt will remain hidden.
LLM08 – Vector and Embedding Weaknesses
RAG architectures introduce another layer of data and access risk. Poorly governed vector stores and embeddings can allow unauthorized retrieval, cross-context leakage, poisoning, or disclosure of sensitive source information.
LLM09 – Misinformation
A model can produce inaccurate or fabricated information that appears credible, and the business risk increases when people or automated processes rely on that output without verification. OWASP specifically identifies hallucination, bias, incomplete information, and overreliance as contributors.
LLM10 – Unbounded Consumption
AI also introduces availability and economic risks. Uncontrolled inference can create denial-of-service conditions, drive excessive cloud costs, degrade service, or even facilitate model extraction. AI resource governance therefore becomes part of both cybersecurity and financial risk management.
For professionals seeking deeper engagement, the full OWASP documentation and emerging frameworks for AI governance are valuable next steps.
Taken individually, these look like technical risks.
Taken together, they reveal something larger.
AI governance cannot be separated from enterprise governance.
Organizations need to know which AI systems are being used, what data they can access, what identities and permissions they operate under, which third parties and models they depend on, what actions they are authorized to perform, how outputs are validated, and who remains accountable when those systems make or influence decisions.
That means mature AI risk management should not begin with a completely separate security universe. It should extend the disciplines we already understand risk assessment, data classification, identity and least privilege, and so on while acknowledging the need to adapt familiar practices to the unique aspects of AI.
· Risk assessment.
· Data classification.
· Identity and least privilege.
· Third-party risk management.
· Secure development.
· Change management.
· Logging and monitoring.
· Incident response.
· Human oversight.
But the implementation has to evolve because the technology has evolved.
The difficult part of AI governance will not be writing a policy that says “use AI responsibly.”
It will be creating governance that can adapt as models, agents, integrations, capabilities, and risks change faster than traditional policy cycles.
The objective should not be to eliminate AI risk. That is neither realistic nor useful.
The objective is to understand where AI changes the organization’s attack surface, decision surface, and trust boundaries, then apply controls proportionate to the business impact.
AI may be new. The responsibility to understand, govern, and manage risk is not.
Matt Shannon, Security Pro 