No single tool checks an LLM app. You need dependency and static scanners for the code around the model, secret scanning for keys, an adversarial test harness for prompts and tools, runtime guardrails and approval controls for live traffic, and logging for investigation. Match each tool type to the risk it addresses in the OWASP list.
Definitions
LLM app. Software that sends user or system content to a language model and acts on the output, often with retrieval, tools or agents attached.
OWASP Top 10 for LLM Applications 2025. A list of ten risks: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption.
Tool types mapped to risks
| Tool type | Checks | OWASP risks it helps with |
|---|---|---|
| Dependency and SBOM scanning | Vulnerable or malicious packages, model and library provenance | Supply chain |
| Static analysis | Unsafe handling of model output, injection sinks, missing authorization | Improper output handling, excessive agency |
| Secret scanning | API keys in code and config | Sensitive information disclosure, unbounded consumption |
| Adversarial test harness | Prompt injection, leakage, tool abuse under test | Prompt injection, system prompt leakage |
| Retrieval review | Access control and poisoning in the vector store | Vector and embedding weaknesses, data poisoning |
| Runtime guardrails | Screening of inputs, outputs and actions | Prompt injection, excessive agency |
| Approval and permission controls | Human sign-off for high-impact actions | Excessive agency |
| Quotas and rate limits | Spend and abuse | Unbounded consumption |
| Logging and monitoring | Evidence for detection and response | All of them |
How to choose, step by step
- Draw the app. Mark where untrusted text enters, which tools the model can call, and what data it can reach.
- Pick the first risk by shape. A chat widget with no tools leans on output handling and leakage. An agent with tools leans on excessive agency and permissions.
- Cover the plumbing first. Dependency scanning, secret scanning and static analysis are mature and catch common problems around the model.
- Add adversarial testing for your channels. Use test cases that match your retrieval sources and tools.
- Add runtime controls that limit impact. Least privilege, human approval and rate limits do not depend on the model behaving.
- Treat model-based guardrails as one layer. OWASP's cheat sheet describes them as one layer, not a replacement for other controls. The NCSC advises being sceptical of any claim to stop prompt injection outright.
- Turn on logging of inputs, outputs and tool calls, keeping sensitive data out.
What to ask any vendor
- Which risks does the tool address, and which does it not?
- How does it behave when the check itself errors?
- Where does it run and what data does it see?
- What evidence does it produce for an audit?
Try it yourself
Click through it at your own pace, or open it full screen. This shows the dependency inventory layer, the first row of the table.
Quick check
Is one platform enough?
Rarely. Even a broad platform may cover some rows and not others. Map your risks to the table and look for gaps.
Do I need a guardrail product if I have least privilege?
Least privilege limits damage when the model is fooled. Guardrails may reduce how often it is. They address different parts of the problem.
Where should a small team start?
Dependency, secret and static scanning in CI, plus least privilege and approval on any tool that can change something.
Where Safeguard fits
Safeguard covers dependency and SBOM scanning, reachability analysis, policies and gates, an MCP Guardrail and compliance evidence automation. You can start with a free scan at gold.safeguard.sh/scan.
Sources
- OWASP Top 10 for LLM Applications
- OWASP LLM Prompt Injection Prevention Cheat Sheet
- NCSC on prompt injection
Last reviewed: 19 October 2026.
