They should use the frameworks together, because each addresses a different layer of the problem. OWASP is useful for application risk, CSA for orchestration and autonomy, NIST for governance and accountability, and MITRE for adversary behaviour. The right choice is not one framework, but a mapped set of controls across all four.
Why This Matters for Security Teams
AI security fails when organisations treat one framework as a full operating model. OWASP is strongest for application-layer weaknesses, CSA is better for orchestration and autonomy, NIST is the clearest anchor for governance and accountability, and MITRE is useful for adversary behaviour and detection planning. For teams operating LLMs, agents, or AI-enabled workflows, the real risk is a control gap between model development, runtime use, and incident response.
The practical challenge is that each framework answers a different question. OWASP helps identify what can be abused in the application path, CSA helps model how agentic systems can misbehave across tools and workflows, NIST helps define ownership and risk tolerance, and MITRE helps security teams reason about attack patterns and defensive coverage. The NIST Cybersecurity Framework 2.0 is useful here because it helps organisations connect AI-specific controls to wider security outcomes instead of leaving them as isolated review items.
In practice, many security teams encounter AI risk only after a model has already been connected to sensitive data, external tools, or privileged workflows, rather than through intentional control design.
How It Works in Practice
A sensible deployment pattern is to map each framework to a different layer of the AI stack. OWASP is best used during design and code review to spot issues such as prompt injection exposure, insecure tool use, weak output handling, and identity abuse through non-human accounts. The OWASP Agentic AI Top 10 and the OWASP Non-Human Identity Top 10 are especially useful when agents authenticate to APIs, secrets managers, or SaaS platforms.
CSA becomes most relevant when the AI system is autonomous enough to plan actions, chain tools, or trigger business processes. Its threat modelling approach helps teams ask whether the agent can exceed intent, persist access, or create unsafe side effects. NIST provides the policy backbone: define accountable owners, risk appetite, approval gates, logging expectations, and post-deployment monitoring. MITRE then helps security teams translate AI misuse into observable behaviours and threat hunts. The MITRE ATLAS adversarial AI threat matrix is particularly useful for mapping model poisoning, evasion, extraction, and misuse scenarios into testable detections.
- Use OWASP for application and integration review.
- Use CSA for autonomy, workflow, and agentic threat modelling.
- Use NIST to define governance, ownership, and monitoring requirements.
- Use MITRE to convert threats into detections, hunts, and response playbooks.
For GenAI-specific governance, the NIST AI 600-1 GenAI Profile is useful for adding implementation detail around model risk, data integrity, and output management. These controls tend to break down when AI systems are deployed through shadow IT, because ownership, logging, and change control are usually missing.
Common Variations and Edge Cases
Tighter AI governance often increases delivery overhead, requiring organisations to balance model velocity against assurance. That tradeoff is real, especially where product teams want rapid experimentation and security teams need repeatable review checkpoints. There is no universal standard for how to combine OWASP, CSA, NIST, and MITRE, so current guidance suggests using a layered mapping rather than trying to force one framework to do everything.
Edge cases matter. Pure model evaluation work may lean more heavily on NIST and MITRE, while agentic systems with tool access need OWASP and CSA for stronger operational coverage. Where AI touches human identity, secrets, or non-human accounts, the overlap with identity governance becomes critical. For example, the NIST IR 8596 Cyber AI Profile can help frame monitoring and control selection for cyber-enabled AI use cases, while Anthropic’s Project Glasswing is a reminder that the industry is still experimenting with better ways to govern advanced agent behaviour.
Best practice is evolving, but the decision rule is stable: use NIST for governance, OWASP for application weakness, CSA for autonomous workflow risk, and MITRE for adversary modelling. That combined view is especially important when AI systems can call tools, read secrets, or act on behalf of users without direct human approval.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATLAS, OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | AI RMF provides the governance spine for accountability and risk management. | |
| MITRE ATLAS | TID-0001 | ATLAS models adversarial AI behaviours like poisoning, evasion, and extraction. |
| OWASP Agentic AI Top 10 | Agentic AI guidance covers tool abuse, prompt injection, and autonomous misuse. | |
| OWASP Non-Human Identity Top 10 | AI agents often rely on non-human identities, secrets, and API credentials. | |
| CSA MAESTRO | MAESTRO addresses threat modelling for autonomous and agentic AI systems. |
Assign AI owners, define risk appetite, and monitor AI controls through the RMF GOVERN and MAP functions.
Related resources from NHI Mgmt Group
- How should organisations govern AI use when responsibility is split across security, legal, HR, and compliance?
- Should organisations use security skill prompts instead of access controls for AI agents?
- How should security teams govern AI agents that use OAuth access?
- How should security teams use AI in secret scanning without creating new blind spots?
