Welcome to this week’s edition.

I see people collecting AI security frameworks like Pokémon cards now.

NIST. OWASP. MITRE. ISO. MAESTRO. ATLAS. STRIDE. SLSA. CycloneDX (Not a framework, but you get it)d...

You do not need all 21.

The better approach is to understand what problem each framework solves, then combine a few of them around the system you are actually securing.

I mapped the landscape into four buckets:

Here are the ones I would actually know in 2026.

Let’s get into it ~

Start here if you are designing an enterprise AI governance program.

Probably the most useful general-purpose AI governance framework today.

The core is simple:

Govern → Map → Measure → Manage

It gives you a lifecycle for identifying AI risks, measuring them, deciding how to treat them and continuously governing the system.

NIST is also updating AI RMF 1.0 and introduced additional work around GenAI and critical infrastructure.

Think of this as the AI equivalent of building a formal management system.

ISO 42001 defines an Artificial Intelligence Management System, or AIMS, covering areas such as:

A newer standard worth watching is ISO/IEC 42005:2025, which focuses specifically on AI system impact assessments.

If you build or deploy AI in Europe, this is not optional reading.

The EU AI Act provides the regulatory layer, using its risk-based classification of AI systems and corresponding obligations.

Simple way to remember the stack:

NIST tells you how to manage AI risk.
ISO tells you how to build the management system.
The EU AI Act tells you what the law expects.

Governance tells you how to manage risk.

Threat modeling tells you how somebody is going to break the system.

Still useful.

And every category still maps back to a security property:

Spoofing → Authentication
Tampering → Integrity
Repudiation → Non-repudiation
Information Disclosure → Confidentiality
DoS → Availability
Privilege Escalation → Authorization

None of that became unimportant because we added an LLM.

This should probably be your first AI-specific security reference.

OWASP released its updated GenAI LLM Top 10 2026 in August.

It gives you the AI-native risks STRIDE alone will not surface cleanly, including prompt injection, excessive agency, supply chain weaknesses, vector and embedding risks, sensitive information disclosure and unbounded consumption.

ATLAS is basically the adversary-behavior layer.

MITRE now maps attacks across predictive AI, GenAI and agentic AI, with techniques covering things like:

If you already know ATT&CK, ATLAS feels very natural.

This is one I would add to the 2026 list.

CSA's MAESTRO was designed specifically for agentic and multi-agent systems.

Instead of only asking what attack is possible, it walks through the architectural layers of an agent system and asks where the risk actually exists.

As agents, MCP and multi-agent architectures become normal, I expect MAESTRO to become much more relevant.

A threat model with 70 findings is useless if nobody knows what to fix first.

This is where risk prioritization comes in.

The MIT AI Risk Repository is particularly useful because it now contains more than 1,700 AI risks pulled from dozens of existing frameworks.

Then use sources like the AI Incident Database to check whether similar problems have already happened in the real world.

From there, traditional approaches like:

can turn the threat list into an actual security backlog.

The important part is not which scoring formula you choose.

It is moving from:

to:

This is where I think AI teams sometimes make the biggest mistake.

They replace normal application security with AI security.

You need both.

Your LLM application is still software.

So keep using:

CycloneDX is especially interesting because it can also represent ML-BOMs, giving you visibility into AI/ML components and dependencies.

Your AI supply chain now includes more than npm packages.

It can include:

models → datasets → libraries → embeddings → vector databases → MCP servers → external APIs → agent tools.

That needs inventory too.

A few things have moved quickly this year.

OWASP GenAI LLM Top 10 2026
The updated LLM security list was released in August.

Agentic AI security guidance
OWASP's agentic work and CSA MAESTRO are increasingly important as companies move from chatbots to autonomous agents.

MITRE ATLAS for Agentic AI
ATLAS now explicitly maps agentic environments and attacks against tools, credentials, RAG and agent configuration.

NIST AI RMF updates
AI RMF 1.0 is being revised and NIST is developing additional profiles for areas such as critical infrastructure.

ISO/IEC 42005
Adds a structured standard specifically around AI system impact assessments.

The framework landscape is not getting smaller.

Which makes knowing what not to use even more important.

I also wanted to check whether any of this is actually showing up in jobs.

So I sampled 12 current public AI Security and AI Governance postings across companies including Kyndryl, HealthEquity, Aurigo, GuidePoint Security, Vertex, Addepar and others.

This is what appeared:

Small sample, so do not treat this as a scientific labor-market study.

But the pattern was very clear.

For technical AI Security roles, OWASP LLM Top 10 was the most frequently named framework.

For AI Governance roles, NIST AI RMF was the most consistent requirement, usually alongside the EU AI Act or broader regulatory knowledge.

MITRE ATLAS appeared surprisingly often in hands-on AI security roles too.

Do with that information what you want.

If you do not want to spend the next six months reading frameworks, start here:

Governance: NIST AI RMF
Regulation: EU AI Act
AI threats: OWASP GenAI LLM Top 10
Threat modeling: STRIDE
Adversary behavior: MITRE ATLAS
Agentic systems: MAESTRO
Application security: OWASP ASVS
Supply chain: SLSA + CycloneDX

That covers a huge percentage of what most teams actually need.

No single framework covers AI security.

And there probably never will be one.

So before hunting for the definitive AI security framework, open the ones you already half-know and run them against your actual architecture.

That is far more useful than collecting another PDF.

Which of these are you actually using in practice, versus bookmarking for later?

That’s it for this week.

See you in the next one.