OWASP LLM Top 10 in Depth

Home
Paths
OWASP LLM Top 10 in Depth

OWASP LLM Top 10 in Depth

A guided, multi-course journey that builds this skill from the ground up. Work through the chapters in order, or jump to any lesson.

Progress0%

1Frame the Lumen Bank Threat Model 2Draft System Scope and Assets 3Write Rules of Engagement 4Define the Finding Lifecycle 5Set Up ATLAS and RMF Mapping 6Decide Trust or Escalate Thresholds

7Trace Prompt Injection in the Workflow 8Run a Direct Injection Test Safely 9Probe Indirect Injection Through Retrieval 10Test Injection Pressure on Agent Tools 11Write LDB-F01 and the Retest Plan

12Mapping Where Bank Data Leaks 13Running Safe Leakage Checks 14Redacting Evidence Without Losing Proof 15Drafting LDB-F02 and Retest Plan

16Mapping Hidden Context in Lumen Systems 17Tracing How Hidden Context Leaks 18Executing a Safe Hidden-Context Test 19Writing LDB-F03 and Retest Evidence

20Spotting When an Agent Overreaches 21Inventorying Tools for Least Privilege 22Defining Consequential Actions and Approvals 23Testing Overreach With Benign Scenarios 24Writing Finding LDB-F04 and Retest Proof

25Map the AI Supply Chain Surface 26Define Provenance and Integrity Evidence 27Run the “Prove It” Supply Review 28Write and Verify the Supply Finding

29Scoping Poisoning Surfaces and Trust 30Detecting RAG Corpus Poisoning 31Detecting Training and Artifact Poisoning 32Writing LDB-F06 and Retest Evidence

33Mapping Retrieval Trust Boundaries 34Probing Cross-Tenant Retrieval Leakage 35Writing Finding LDB-F07 for LLM09 36Verifying Retrieval Isolation Controls

37Defining Verifiable Grounding for Decisions 38Running Attempt-First Misinformation Tests 39Documenting LDB-F08 and Retest Proof

40Mapping Output Sinks and Trust Boundaries 41Probing Unsafe Rendering and Interpretation 42Writing LDB-F09 and Retest Checks 43Verifying Controls by Output Sink

44Map Consumption Drivers and Limits 45Test Caps on Token and Retrieval Growth 46Break Agent Loops With Circuit Breakers 47Write LDB-F10 and Retest Checklist

48Assemble the Lumen Risk Register 49Finalize OWASP–ATLAS–NIST Mappings 50Package Retest Evidence for Closure 51Deliver the Executive Risk Briefing

Related content