What Is Threat Catalog? Definition & Examples

A structured list of things that can go wrong in an AI system. Threat catalogs help security teams share vocabulary, scope red teaming, and map risks to mitigations, but they do not by themselves define governance or lifecycle sequencing. They are most useful when paired with a management framework and an execution framework.

What a Threat Catalog Does

A threat catalog is a structured inventory of potential failure modes, attack paths, and abuse patterns for a system. In AI security, it gives teams a shared vocabulary so they can name threats consistently, compare findings across projects, and avoid rediscovering the same issues in different forms.

Its main value is organisational and analytical, not authoritative. A catalog helps people think clearly about what can go wrong, but it does not itself decide policy, assign ownership, or sequence controls. That is why it is usually paired with a management framework that defines accountability and an execution framework that turns identified threats into concrete work.

Why Threat Catalogs Matter in AI Security

AI systems tend to combine models, prompts, tools, retrieval, plugins, data pipelines, and orchestration layers. That mix creates many threat entry points, so a catalog is useful for grouping issues such as prompt injection, data exfiltration, tool misuse, model manipulation, and abuse of connected services into a repeatable structure.

Good catalogs reduce ambiguity in red teaming and threat modelling. They help practitioners scope tests, compare similar risks across environments, and map each threat to a mitigation category instead of treating every issue as a one-off event.

How Teams Use a Threat Catalog

Practitioners usually use a catalog as a reference point during design reviews, threat modelling sessions, red team planning, and control mapping. It is most effective when the catalog is treated as a living reference rather than a static checklist, because AI systems and attack techniques evolve quickly.

A useful catalog should support discussion across security, engineering, product, and governance teams. It should make it easier to ask whether a threat is relevant to the system, what assumptions it breaks, and which mitigations reduce the exposure most effectively.

Threat Catalogs Versus Governance and Control Frameworks

A threat catalog describes what can go wrong, while a governance framework defines who is responsible and how decisions are made. An execution framework then translates those decisions into practices such as testing, monitoring, hardening, and response. That separation matters because catalogs are informative, but they are not sufficient on their own for lifecycle control or organisational accountability.

For AI programmes, the best outcome usually comes from pairing the catalog with a management layer that sets risk ownership and a control layer that drives implementation. Without that pairing, teams may identify threats accurately but still fail to prioritise, mitigate, or revisit them consistently.

Risk and Threat Considerations

A threat catalog can become a false sense of security if teams treat the list itself as a control. The risk is not the existence of the catalog, but the possibility that serious threats are documented, discussed, and then left without ownership, testing, or remediation.

Failure mechanism: Weak catalogs often blur distinct threats together, omit system-specific attack paths, or stay detached from real controls, which leaves gaps between identification and action.

Impact: That gap can let high-value AI attack paths remain untested, mis-prioritised, or repeatedly rediscovered only after misuse, data exposure, or production compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Agentic AI Top 10 and MITRE ATLAS address the attack surface, NIST AI RMF sets the technical controls, and ISO/IEC 42001:2023 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST AI RMF	Govern	Threat catalogs support AI risk governance and structured risk identification across AI systems.
Recommendation — Use threat catalogs to inform AI risk governance decisions and track which threats require treatment.
ISO/IEC 42001:2023	AI management system requirements	Threat catalogs feed documented AI risk processes and accountability within an AI management system.
Recommendation — Incorporate the catalog into AI management system risk assessments, reviews, and accountability processes.
OWASP Agentic AI Top 10	ASI01 — Agent Goal Hijack	Agent goal hijack is a named threat pattern that belongs in structured AI threat catalogs.
	ASI02 — Tool Misuse	Tool misuse is a catalog-worthy threat for agentic systems with external action and tool access.
Recommendation — Map goal-hijack scenarios to testing and controls that constrain agent objectives and task scope. Inventory tool-misuse paths and validate that tool permissions match intended agent actions.
MITRE ATLAS	Adversarial AI techniques knowledge base	ATLAS provides a structured adversarial AI technique catalog for threat modelling and red teaming.
Recommendation — Use ATLAS to map observed AI threats to techniques and drive targeted detections and mitigations.

Practitioner Guidance

Why practitioners should care: Use the catalog as a shared reference, not as the end state. The practical question is whether each listed threat can be traced to a relevant control, test, or owner in your environment.

Common misunderstanding: Teams sometimes assume that a broad catalog automatically improves security maturity. In practice, its value depends on how well it is integrated into threat modelling, red teaming, and remediation workflows.

Practitioner takeaway: Treat the catalog as a vocabulary layer and make sure every important threat can be connected to a decision, a test, or a mitigation path.

Threat Catalog