Why so many AI security programs start with the OWASP Top 10

When an auditor or an RFP asks how your organization handles AI risk, the OWASP Top 10 lists are often a core part of the checklist behind the question. Cato AI Security is built to address the risks on two lists.

What OWASP is

The Open Worldwide Application Security Project (OWASP) is a nonprofit foundation with a global community of security practitioners. It publishes free security guidance, and volunteers lead its projects and local chapters worldwide.

Its GenAI Security Project publishes several lists. Two of the most widely used are the OWASP Top 10 for LLM Applications (2026) and the OWASP Top 10 for Agentic Applications (2026). Each list ranks the 10 most critical risks that an AI security program should cover. Many security teams treat the lists as an industry standard and plan their AI security work around them.

The LLM list covers applications with a model embedded inside them, where risks include prompt injection and sensitive data leaking in a response. The agentic list covers what changes once agents plan tasks and call tools on their own.

The OWASP lists give each AI Security team the same set of risks to work from:

• App developers use them as a guide to the risks their applications should avoid.
• Security vendors build their products around them.
• Auditors use them to assess the risk in an AI platform.
• Buyers use them to evaluate AI security platforms.

Mitigating those risks is a responsibility shared by the security vendor and the teams that build and run your AI apps and agents. A security platform can stop some risks on its own. Others also need work in the app, the data pipeline or the agent platform.

How Cato AI Security maps to OWASP

Cato AI Security covers the risks on both lists in three ways:

• Direct protection: Cato stops the risk in line, before the AI application or agent acts.
• Shared protection: Cato reduces the risk and works with your app developers on the rest.
• Platform evidence: Cato logs every AI interaction in an audit-ready format, so your team can investigate and show auditors what happened.

Cato AI security runs AI Security for Users, Applications, and Agents with unified visibility, context, and control, so the same inspection and policy applies to every risk below. The OWASP risks fall into three groups.

Supply chain risks

AI apps and agents rely on models, MCP servers and skills that someone else built. If one of them is compromised, every agent that uses it inherits the problem. OWASP lists this as Supply Chain (LLM04) and Agentic Supply Chain Vulnerabilities (ASI04).

A security team can’t set a policy for tools it can’t see. Cato protects against supply chain risk by discovering MCP servers and skills connected to agents and coding tools, including ones IT never approved, and applying policy to each one.

Prompt injection and sensitive data exposure

Attackers can hide instructions in content a model or agent reads and make it act against your policy. Employees can also paste API keys or personal data into an AI app. OWASP lists these as Prompt Injection (LLM01), Agent Goal Hijack (ASI01) and Sensitive Information Disclosure (LLM02).

Cato AI Security protects against prompt injection and data exposure through runtime guardrails on AI agents and the custom applications your teams build. It inspects each prompt and response in line, along with the results tools send back to an agent. Cato blocks prompt injection and jailbreak attempts before the model or agent acts.

The same inspection finds sensitive data in prompts and responses and in files attached to AI apps.

Tool misuse and excessive agent access

An agent with access to tools can change records and run commands. If it has more access than it needs, one bad instruction can cause serious damage. OWASP lists these as Excessive Agency (LLM03), Tool Misuse and Exploitation (ASI02) and Unbounded Consumption (LLM06).

Cato AI Security lets your security team name the tools, MCP servers and skills an agent may use, and block or monitor each one. Your security team can also set limits on how much apps and agents spend on model usage.

Where your team’s work starts

Some risks sit partly outside the traffic path. For these types of risks, Cato AI Security works alongside your team or provides platform evidence:

• Data and model poisoning (LLM05): Cato AI Security detects manipulated context in live interactions, while your data pipeline owners protect training and fine-tuning data.
• Rogue agents (ASI10): Cato AI Security keeps an inventory of agent activity and applies policy to each agent in line, while your agent platform owns the kill switch.

Cato’s AI interaction logs sit beside network, cloud access security broker (CASB) and endpoint data on one platform, so an analyst doesn’t have to pull logs from separate tools to investigate.

Get the full mapping from your Cato representative

Talk to your Cato representative to receive the complete map of how Cato covers the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications. We’ll go through the OWASP lists with you and map them against the apps and agents you run today, one use case at a time. You’ll see our coverage for each risk and how we work with your team to mitigate each one.