The CISO’s Rosetta Stone: Mapping AI Agent Security Across OWASP, NIST, and Open Security Architecture

Your existing security controls already cover approximately 80% of AI agent risk. The gap is understanding how your existing NIST 800-53 controls, your ISO 27001 programme, and your incident response procedures map to the new attack patterns that AI agents introduce.

OWASP GenAI — The Attack Surface Map

Top 10 for LLM Applications (v2.0, 2025)

LLM01Prompt Injection

Attackers embed instructions in content the model processes. In agentic contexts, equivalent to remote code execution. NIST: SI-10, AC-03, SC-07

LLM02Insecure Output Handling

Model outputs treated as trusted data by downstream systems without sanitisation. Creates classic injection chains. NIST: SI-10, SC-04, CM-07

LLM03Training Data Poisoning

Fine-tuning on compromised datasets introduces persistent biases, backdoors, or deliberate blind spots. NIST: SI-07, SR-03, RA-05

LLM05Supply Chain Vulnerabilities

Compromised models, datasets, plugins, RAG pipelines, or embedding libraries. Silent compromise through updates. NIST: SR-02, SR-03, SR-11

LLM06Sensitive Information Disclosure

Models memorise and regurgitate training data; RAG systems leak unauthorised documents. GDPR violations, credential exposure. NIST: SC-28, AC-03, AC-06

LLM08Excessive Agency

Models granted more autonomy than needed. When failures occur, blast radius is maximised. NIST: AC-06, AC-05, CM-07

Top 10 for Agentic AI (December 2025)

A01Excessive Agency / Uncontrolled Autonomy

Agents permitted to take consequential actions without human confirmation. Example: HR agent autonomously terminates contractor access.

A02Insufficient Human Oversight

High-stakes decisions without human-in-the-loop. Example: Security triage agent closes 200 alerts; 12 were real incidents.

A04Memory Poisoning / State Manipulation

Attackers write to agent persistent memory (vector databases, conversation histories). Corrupts future decisions.

A09Insufficient Logging/Observability

Complex multi-step reasoning chains lack structured logging. Example: Financial error has only “Agent completed task” in logs.

A10Privilege Escalation Through Agent Chains

Low-privilege agent calls higher-privilege orchestrator, combined with prompt injection for escalation.

NIST — The Control Backbone

47 NIST 800-53 Rev 5 controls map directly to AI agent risks. Key families:

Access Control (AC)

AC-03: Enforce auth on agent tool invocations
AC-05: Separate recommendation from execution agents
AC-06: Scope all agent credentials to minimum required

System Integrity (SI)

SI-04: Monitor agent behavior in real-time
SI-07: Verify integrity of model weights and plugins
SI-10: Validate all inputs for prompt injection

Communications (SC)

SC-07: Enforce network controls between trust zones
SC-08: Encrypt all inter-agent communications
SC-28: Encrypt agent memory stores and vector DBs

Supply Chain (SR)

SR-02: Include AI providers in supply chain risk
SR-03: Require AIBOMs and model cards
SR-11: Verify model weight and plugin authenticity

OSA SP-027 — Trust Zone Architecture

Open Security Architecture defines four trust zones for AI agent deployments:

Zone 1 — Human Interaction Layer

Identity verification, session management, human-in-the-loop checkpoints, deepfake detection

Zone 2 — Agent Execution Environment

Prompt sanitisation, output validation, tool call authorisation, inter-agent authentication, monitoring

Zone 3 — Enterprise Systems

Extend existing enterprise IAM, data classification, API gateways to cover NHI access patterns

Zone 4 — AI Provider

API key management, data minimisation in prompts, contractual security requirements, provider monitoring

NIS2 Implications

Article 21 — Risk Management

AI agents processing personal data, accessing operational systems, or influencing critical decisions are in scope for Article 21 risk management. Measures map directly to NIST controls: network security (AC-03, SC-07), incident handling (IR-01, IR-04), supply chain (SR-02, SR-03), vulnerability handling (RA-05).

Article 23 — Incident Reporting

Significant incidents must be notified within 24 hours (early warning) and full report within 72 hours. Challenge: When do you “become aware” when an agent silently exfiltrates data over 72 hours through repeated small queries?

The fix: Instrument agents with behavioural baselines. Flag anomalies in real-time. Integrate agent activity into SIEM. Treat unusual tool call patterns as potential incident triggers.

Five Monday Morning Actions

Inventory AI agents — Shadow AI is common. Use DLP tools, proxy logs, OAuth logs to surface actual deployments.
Apply trust zone framework to top 3 deployments — Map against SP-027’s four zones. Surface access control gaps.
Check NHI posture for AI service accounts — Is each scoped to least privilege? Has an owner? Being monitored?
Add AI scenarios to next tabletop — Agent exfiltrating data, sending phishing emails, modifying financial records.
Brief the board with framework mapping — Attack surface (OWASP) → Controls (NIST) → Gaps (SP-027) → Closure plan.

Quick Wins vs Strategic Investments

Quick Wins (0–30 days)

Enable audit logging on all AI API calls
Review service account permissions
Add AI supply chain to risk register
Run OSA’s free maturity assessment

Medium-term (30–90 days)

Implement prompt injection detection
Deploy agent behaviour monitoring
Establish AIBOM process
Define human-in-the-loop thresholds

Strategic (90+ days)

Full NHI governance programme
Build AI red team capability
Pursue ISO 42001 certification
Agent-specific IR playbooks

Key takeaway: Every AI agent risk in this mapping has an existing NIST 800-53 control. You do not need a new control framework. You need to apply the controls you already have to the AI context.