OWASP list
The OWASP Top 10 for LLM applications, in plain terms
OWASP's 2025 list names ten risks for applications built on LLMs, led by prompt injection. It works well as a review checklist for any AI tool you deploy.
Last reviewed against NCSC, Department for Science, Innovation and Technology and OWASP GenAI Security Project. Sources
The list
Ten risks
The OWASP GenAI Security Project publishes the 2025 edition [8]. The entries are:
| ID | Risk |
|---|---|
| LLM01 | Prompt Injection |
| LLM02 | Sensitive Information Disclosure |
| LLM03 | Supply Chain |
| LLM04 | Data and Model Poisoning |
| LLM05 | Improper Output Handling |
| LLM06 | Excessive Agency |
| LLM07 | System Prompt Leakage |
| LLM08 | Vector and Embedding Weaknesses |
| LLM09 | Misinformation |
| LLM10 | Unbounded Consumption |
How to use it
A review checklist
For each AI tool, ask which of the ten apply, then record the control that answers each. Start with LLM01 and LLM02, the first two entries in the list [8]. Keep the result as a short table: risk, tool, control, owner.
One way to group them
Some risks concern what goes in (LLM01, LLM04), some what comes out (LLM02, LLM05, LLM09) and some what the tool can do (LLM06, LLM10). This grouping is ours, not OWASP's; the list itself is numbered only [8].
Prompt injection
The top entry in detail
OWASP describes two forms. In direct injection, a user's prompt alters the model's behaviour. In indirect injection, the model reads external content such as a website or file that contains instructions [9]. It lists seven mitigations, among them least privilege, human approval for high-risk actions and regular adversarial testing [9].
Limits
What the list does not do
OWASP says it is unclear whether fool-proof prevention of prompt injection exists, given the stochastic nature of generative AI [9]. The mitigations it lists aim to reduce impact. The NCSC takes the same line [1].
A list is a start
Use it to structure a review, then add the controls in the controls guide and the practical plan.
Keep reading
Read next
Questions
Sourced answers on AI security: what it is, whether prompt injection can be fixed, shadow AI, the UK code of practice and what to do first.
Read the guide
Risks
The AI security risks UK organisations face, from prompt injection to data exposure and over-broad access, with NCSC and OWASP evidence.
Read the guide
Plan
A practical AI security plan for UK organisations: inventory, least privilege, human approval, logging and ownership, drawn from NCSC advice.
Read the guideHow CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
AI security starts with knowing which tools are in use, who owns them and what they can reach. CyPro can help set the governance, accountability and controls around that.