Treat "covers the OWASP LLM Top 10" as a prompt for questions, not an answer. The 2025 list has ten different risks, from prompt injection to unbounded consumption, and they are detected in different ways. Ask which categories the tool addresses, at what stage, and with what evidence.
The ten categories
The current edition is the OWASP Top 10 for LLM Applications 2025:
- LLM01 Prompt Injection
- LLM02 Sensitive Information Disclosure
- LLM03 Supply Chain
- LLM04 Data and Model Poisoning
- LLM05 Improper Output Handling
- LLM06 Excessive Agency
- LLM07 System Prompt Leakage
- LLM08 Vector and Embedding Weaknesses
- LLM09 Misinformation
- LLM10 Unbounded Consumption
Why a single claim is vague
These risks live in different places. Some sit in how an application builds prompts. Some sit in what an agent is allowed to do. Some are about the components and models you pull in. A tool that watches network traffic cannot say much about training data, and a tool that reads dependency manifests cannot say much about a prompt.
So a good answer from a vendor is a table, not a sentence.
Questions to ask
- Which of the ten categories does the product address directly, and which does it only mention?
- At what stage does it act: design, build, deploy or runtime?
- Is the control detective, preventive, or advisory?
- What evidence can you see, such as a sample finding or log line?
- How was the mapping produced, and for which edition of the list?
- What does it not cover?
The last question is often the most telling. An honest answer names gaps.
A worked example of a good answer
Imagine a vendor says its product addresses Excessive Agency. A weak answer is "yes, we cover it." A strong answer names the control: for instance, that every tool an agent can call is listed, each call is checked against a policy, and the log shows who or what made the call and what was allowed. You can then ask to see that log and decide whether it satisfies your own definition of the risk.
Apply the same test to every category the vendor claims. If the answer is a slide with ten green ticks, ask for ten examples. If a category is not claimed, that is not a flaw. It tells you where you still need another control, another tool or a process.
Mapping to the work you already do
Some categories connect to existing practice. LLM03 Supply Chain relates to the components and model artifacts you depend on, so inventory and dependency checks apply. LLM06 Excessive Agency relates to what permissions an agent holds, which is an identity and policy question. LLM10 Unbounded Consumption relates to limits and monitoring. Matching each category to a team that already owns the control keeps you from buying overlapping tools.
For agent specific controls, see the rule of two for agents.
Where Safeguard fits
Safeguard offers an MCP Guardrail, agent identity, and policies, gates and guardrails, along with SBOM and dependency scanning. A free scan is at gold.safeguard.sh/scan.
Quick check
Is the LLM Top 10 a certification?
No. It is a list of risk categories. A vendor can map features to it, but there is no certification attached.
Sources
Last reviewed: 19 October 2026.
