ISO/IEC 27090 vs OWASP LLM Top 10 vs MITRE ATLAS: how they fit

These three sources answer different questions. The OWASP Top 10 for LLM Applications ranks risks for builders. MITRE ATLAS catalogs how adversaries attack AI systems. ISO/IEC 27090 is a paid international standard offering guidance on AI security threats and mitigations. Most teams end up using all three, each for a separate job.

What is the OWASP Top 10 for LLM Applications?

It is a ranked list of the main risks in applications built on large language models, published by the OWASP Gen AI Security Project. The 2025 edition names ten entries:

1. LLM01 Prompt Injection
2. LLM02 Sensitive Information Disclosure
3. LLM03 Supply Chain
4. LLM04 Data and Model Poisoning
5. LLM05 Improper Output Handling
6. LLM06 Excessive Agency
7. LLM07 System Prompt Leakage
8. LLM08 Vector and Embedding Weaknesses
9. LLM09 Misinformation
10. LLM10 Unbounded Consumption

Each entry comes with mitigation advice. For prompt injection, the project lists steps such as constraining model behavior, validating expected output formats, filtering input and output, enforcing least privilege, requiring human approval for high-risk actions, segregating external content and running adversarial tests.

It is a risk list, not a control framework. It does not tell you how an auditor would test your program.

What is MITRE ATLAS?

MITRE describes ATLAS, short for Adversarial Threat Landscape for AI Systems, as a public knowledge base of adversary tactics and techniques targeting AI systems. The public data repository organizes it into tactics (the attacker's goals), techniques and sub-techniques (the methods), mitigations, and case studies of documented attacks. Case studies link to the techniques they used, and mitigations link to the techniques they counter.

If you know MITRE ATT&CK, the shape will feel familiar. The ATLAS repository also ships tooling that can combine ATLAS data with ATT&CK Enterprise data. I could not read a page that spells out the exact relationship between the two, so I will not describe it further.

ATLAS suits red teams, threat modelers and detection engineers. It answers "how would someone actually do this to us?" rather than "which risks rank highest?"

What is ISO/IEC 27090?

ISO/IEC 27090 is a standard from ISO/IEC JTC 1/SC 27 titled, in its final draft, as guidance for addressing security threats and compromises to artificial intelligence systems. Public pages describe it as helping organizations understand the consequences of AI-specific threats across the lifecycle and how to detect and mitigate them. It is meant for organizations of any size that develop or use AI systems.

Here is what I could and could not confirm:

• ISO's public listing shows it as under publication. A commentary site marks it as a draft at the final stage and says publication is likely later in 2026. Check ISO for the current status before you cite it.
• Commentary on a draft says the main clauses are likely to cover applying information security, threats to AI systems, and mitigations. It also lists likely annexes. Because that comes from a pre-publication draft, the final structure may differ, and I give no clause or annex numbers here.
• The same commentary says the scope centers on deliberate attacks, and names threats such as poisoning, evasion, membership inference and model inversion, model stealing, and prompt or output injection. Treat that as a description of a draft, not the final text.
• I could not read the standard itself. It is paid, and the ISO pages were not fetchable for me. I cannot tell you what its requirements, wording or controls say.

How do they fit together?

Think of three layers.

OWASP is the checklist for builders. Use it to brief engineers and to set test cases for an LLM feature before launch.

ATLAS is the attacker playbook. Use it to build threat models, plan red team work and write detections, and to find real case studies to learn from.

ISO/IEC 27090 is the formal guidance. Standards matter when a customer, regulator or auditor wants a recognized reference. Based on the public descriptions, it sits alongside other ISO work on AI management, and the commentary says it draws on ISO/IEC 42001 for mitigation. Read the paid text before you design a program around it.

They overlap in content, since poisoning and prompt injection appear across the sources. They differ in audience, format and weight. A standard moves slowly and carries more formal weight.

What to do

1. Inventory your AI systems first: models, data sources, tools and who can reach them.
2. Run a pass of the OWASP LLM Top 10 against each application and record which entries apply.
3. Pick the two or three most likely attack paths and model them with ATLAS techniques and case studies.
4. Buy and read ISO/IEC 27090 once it is published, if customers or auditors in your market ask for it. Do not rely on summaries, including this one.
5. Record your decisions and test results somewhere you can show them. Evidence matters more than which list you cited.

Quick check

Where Safeguard fits

Safeguard's compliance suite includes ISO/IEC 27090 as a framework. It helps teams prepare and keep evidence ready, with continuous monitoring and automated tests. Autonomous remediation is off by default, and customers choose which categories run automatically. This does not make anyone compliant or certified, and ISO does not endorse Safeguard or the suite. The standard's own requirements come from the standard itself.

Sources

• OWASP Top 10 for LLM Applications
• OWASP LLM01 Prompt Injection
• MITRE ATLAS data repository
• ISO/IEC 27090 listing
• ISO27001 Security: ISO/IEC 27090 commentary

Last reviewed: 19 October 2026.