Document 1 of 4 · Coverage map

AI-era SSDLC and security tool coverage map

SSDLC phases P0–P9 mapped to NIST, CISA and OWASP sources.
69 tool coverage capabilities in 10 domains: developer endpoint, code and artifacts, CI/CD, adversarial testing, cloud posture, runtime AI, MCP and tool governance, agentic workloads, infrastructure defense, AI governance.

As of October 2, 2026Prepared for enterprise security architecture & procurement

01What changed in the threat landscape

Developer endpoint incidents

GlassWorm (Oct 2025–Apr 2026): 72 VS Code / Open VSX extensions compromised.
Mini Shai-Hulud (May 2026): persistence through .claude session hooks and .vscode tasks.
s1ngularity/Nx (Aug 2025): local AI CLIs used to harvest credentials.
Amazon Q extension v1.84 (Jul 2025): shipped with an injected wiper prompt.

Security-toolchain compromises

TeamPCP (Feb–Mar 2026): trojanized Trivy, KICS and LiteLLM, then the Checkmarx/Bitwarden CLI path; target was AI API keys.
Mini Shai-Hulud: abused npm OIDC trusted publishing; malicious packages carried valid SLSA attestations.

CI/CD and AI-agent pipeline incidents

HackerBot-Claw (Feb 2026): autonomous bot; exploited pull_request_target and prompt-injected AI code reviewers.
prt-scan: 475 AI-crafted malicious PRs.

MCP and tool-layer incidents

Tool poisoning: 2025.
postmark-mcp (Sep 2025): first malicious MCP server observed in the wild; BCC'd every email.
ContextCrush (Mar 2026): poisoned docs MCP caused agents to read .env files.
EchoLeak (CVE-2025-32711): zero-click exfiltration through indirect prompt injection.

Vulnerability volume and remediation windows

FIRST projection: about 66k CVEs in 2026.
AI-driven discovery programs: Project Glasswing, Big Sleep, XBOW, Codex Security. Time-to-exploit: about 5 days.
CISA BOD 26-04 (Jun 2026) replaced BOD 22-01; risk-based remediation windows of 3, 14 and 60 days.

AI-security acquisitions

Since 2024: Palo Alto, Cisco, Check Point, Zscaler, F5, SentinelOne, CrowdStrike, Cato, Fortinet and A10 each acquired an AI-security startup.
OpenAI acquired Promptfoo (Mar 2026).

02Framework spine

Source groups: NIST; CISA / US government; OWASP / community; other.
Status checked against primary or secondary sources as of October 2, 2026.

Source	Status (Oct 2026)	What it contributes to the SSDLC
NIST
SP 800-218 SSDF v1.1	Final (Feb 2022)	Core SSDLC practice spine: PO / PS / PW / RV
SP 800-218r1 (SSDF v1.2)	Initial public draft, Dec 17 2025	Adds PO.6 continuous improvement and PS.4 reliable updates (staged rollout, rollback)
SP 800-218A (GenAI / foundation model profile)	Final (Jul 2024)	PW.3 data integrity and poisoning checks, PS.1.2 protect training data, PS.1.3 protect weights, PO.5.3 monitor training environments
AI RMF 1.0 + AI 600-1 GenAI Profile	Final; revision under way	GOVERN / MAP / MEASURE / MANAGE; MEASURE 2.7 security and resilience; MANAGE 4.1 post-deployment monitoring
AI 100-2 E2025 Adversarial ML taxonomy	Final (Mar 2025)	Attack classes for threat modeling and red-team test design, including direct and indirect prompt injection against agents and RAG
SP 800-53 Rev 5 (Release 5.2.0)	Final (Aug 2025)	SA-11 developer testing, SR-3/4/11 supply chain, RA-5, SI-2, SI-7, CM-14
SP 800-204D	Final (Feb 2024)	Supply-chain security in CI/CD: provenance, attestations, SBOM
SP 800-207 / 207A	Final	Zero trust; workload identity for cloud-native apps
CAISI agent-hijacking evaluations	Published Jan 2025	Method: multi-attempt adaptive attacks, task-specific success rates. Success rate: 81% adaptive vs 11% baseline.
NCCoE AI Agent Identity & Authorization	Concept paper (Feb 2026)	Agent identity and delegation; project scope not yet set
COSAiS (SP 800-53 overlays for AI)	Discussion drafts only	Five planned overlays, including single-agent and multi-agent. No agent overlay draft yet.
IR 8596 Cyber AI Profile (CSF 2.0)	Preliminary draft (Dec 2025)	Secure / Defend / Thwart framing for the security program
CISA / US government
Secure by Design pledge	Active	Eliminate vulnerability classes, MFA, no default passwords, VDP, CVE/CWE accuracy, logging
Deploying AI Systems Securely (NSA/CISA)	Apr 2024	Validate models before use (hashes, signatures), protect weights, AI-specific logging, red teaming
AI Data Security	May 2025	Data provenance, integrity, poisoning and drift across the data supply chain
Careful Adoption of Agentic AI Services	May 1 2026	Five agent risk classes. Lifecycle guidance covers instruction hierarchy, agent identity, adversarial testing, incremental privilege, short-lived credentials and anomaly monitoring.
2026 Minimum Elements for an SBOM	Final (Jul 2026)	Adds hash, license, tool name and generation context. Scope includes AI software and SaaS.
AI SBOM minimum elements (CISA + G7)	May 2026	AIBOM clusters: models, datasets, infrastructure, security properties, KPIs
BOD 26-04 Prioritizing Security Updates	Jun 2026 (supersedes BOD 22-01)	Risk-based remediation windows: 3 days (exposed + KEV), 14, 60
OMB M-26-05	Jan 2026	Rescinds mandatory SSDF attestation; agencies validate on a risk basis
OWASP / community
Top 10 for LLM Applications	2025 edition; 2026 edition published Aug 2026	Test catalog for LLM apps. Crosswalk 2025 → 2026 in §06.
Top 10 for Agentic Applications (ASI01–ASI10)	Dec 2025	Agent goal hijack, tool misuse, identity/privilege abuse, agentic supply chain, RCE, memory poisoning, inter-agent comms, cascading failures, human trust, rogue agents
MCP Top 10	Beta (Phase 3)	Token exposure, scope creep, tool poisoning, supply chain, command injection, shadow MCP servers, telemetry
AI Testing Guide v1 / GenAI Red Teaming Guide	Nov 2025 / Jan 2025	Test methodology pillars: APP, MOD, INF, DAT
AIVSS	v0.8	Vulnerability scoring for agentic and AI findings
Top 10 CI/CD Security Risks	2022	CICD-SEC-1…10: poisoned pipeline execution, dependency chain abuse, credential hygiene, artifact integrity
ASVS 5.0 / SAMM 2.0 / SCVS	May 2025 / 2020 / 2020	Requirements baseline, program maturity, component verification
CycloneDX 1.6–1.7 (ML-BOM) / SPDX 3.0 AI profile	ECMA-424 / ISO in progress	SBOM and AIBOM formats
Other
MITRE ATLAS	v2026.06, 16 tactics	Adversary TTPs for AI; includes Agentic AI as a platform
SLSA v1.2	Nov 2025	Build Track L1–L3 plus new Source Track
EU AI Act	GPAI enforcement from Aug 2 2026	Art. 50 transparency in effect. Under the Digital Omnibus agreement, Annex III high-risk moves to Dec 2027 and Annex I to Aug 2028.
ISO/IEC 42001 / 42005	2023 / 2025	AI management system; AI impact assessment

OMB M-26-05 (Jan 2026): federal procurement moved from signed SSDF attestation to risk-based validation.

03SSDLC phase map

10 phases: P0–P9.
AI-specific additions to the SSDF lifecycle: P3 Data & model sourcing; agent and tool controls in P2, P7 and P8.
^d = draft.

P0Governcontinuous

P1Plan & require

P2Design & threat model

P3Data & model sourcingAI-specific

P4Developendpoint + code

P5Build & CI/CD

P6Test & verifyadversarial testing

P7Release & deploy

P8Operate & monitorruntime

P9Respond & improve

Phase	Control objective	NIST	CISA / gov	OWASP	Other	Tool coverage areas
P0 Govern	AI and AppSec policy, roles, AI inventory, risk appetite, metrics	SSDF PO.1, PO.2, PO.6^d; AI RMF GOVERN 1.x, 6.x; IR 8596^d	Secure by Design principles; M-26-05 inventory duty	SAMM Governance	ISO 42001; EU AI Act GPAI and Art. 50	AI inventory & risk tiering, AI-SPM discovery feed, regulatory mapping
P1 Plan & require	Classify each use case (predictive, GenAI, agent). Set security requirements for AI, agents and third-party models.	SSDF PO.1.1–1.3 (218A PO.1.3); AI RMF MAP 1.1, 2.x, 4.1; AI 600-1 risk list	Agentic guidance: start with low-risk tasks	ASVS 5.0; LLM06 / ASI03 drive scoping	ISO 42005 impact assessment	Requirements templates, third-party AI risk intake
P2 Design & threat model	Threat model the app, model, data, agents and tools. Design zero-trust identity and an instruction hierarchy.	SSDF PW.1, PW.2; AI 100-2 E2025; SP 800-207/207A; 800-53 SA-8, SA-17, AC-6	Careful Adoption of Agentic AI (design); Deploying AI Systems Securely	LLM01/06/07/08; ASI01/03/07/08/09; MCP02/07/10	MITRE ATLAS	AI threat-modeling tools, agent identity design, MCP gateway architecture
P3 Data & model sourcing	Data provenance and poisoning checks; protect weights and training data; vet pre-trained models and MCP servers.	218A PW.3.1–3.3, PS.1.2, PS.1.3; AI RMF MAP 4.1, MANAGE 3.2	AI Data Security; AI SBOM elements	LLM03, LLM04; ASI04, ASI06; MCP03, MCP04	CycloneDX ML-BOM; SPDX 3.0 AI / Dataset	Model scanning, AIBOM, dataset provenance, MCP registry vetting
P4 Develop	Secure coding (human and AI-generated), secret hygiene, safe defaults, output handling, a controlled developer endpoint	SSDF PO.3, PO.5, PW.4–PW.6, PW.9; 218A PO.5.3; 800-53 SI-10	Secure by Design: eliminate vulnerability classes	ASVS V1/V2/V4/V8/V15; LLM05; ASI05; MCP01/05	OpenSSF Scorecard	IDE/extension control, package firewall, pre-commit secrets and SAST, coding-agent policy
P5 Build & CI/CD	Hardened pipeline, provenance, signing, SBOM and AIBOM, dependency control	SSDF PS.1–PS.3; SP 800-204D; 800-53 SR-3/4/11, CM-14, SI-7	2026 SBOM minimum elements; AI SBOM elements	CICD-SEC-1…10; SCVS	SLSA v1.2; Sigstore	SCA, malicious-package detection, SBOM, runner hardening, provenance, ASPM
P6 Test & verify	SAST, DAST and SCA, plus AI adversarial testing, agent-hijacking tests and guardrail validation	SSDF PW.7, PW.8; 218A PW.3.3; AI RMF MEASURE 2.7; CAISI method; 800-53 SA-11, RA-5	Agentic guidance: adversarial testing during development	AI Testing Guide; GenAI Red Teaming Guide; LLM Top 10; ASI Top 10	ATLAS TTPs	AI red teaming platform, MCP dynamic testing, DAST/API, AI pentest
P7 Release & deploy	Gated release, staged rollout, rollback, guardrails, least-privilege agent credentials	SSDF PS.4^d, PW.9; 800-53 SI-2, SI-7; 800-207A	Deploying AI Systems Securely: validate before use	ASI02/03; MCP02/07/09; LLM10	SLSA verification at admission	Admission policy, AI firewall, MCP gateway, agent identity and OBO authorization
P8 Operate & monitor	Runtime protection, drift, agent telemetry, abuse detection, deception	218A PO.5.3; AI RMF MANAGE 4.1; 800-53 SI-4, AU-2, AU-12, CA-7	Agentic guidance: logging and anomaly monitoring	MCP08; ASI08/10; LLM09/10; CICD-SEC-10	ATLAS detections	Agent detection & response, agent observability, AI SOC, honeytokens, continuous red teaming
P9 Respond & improve	Vulnerability intake, AI-aware scoring, patch SLAs, root cause, disclosure	SSDF RV.1–RV.3, PO.6.3^d; AI RMF MANAGE 4.3; 800-53 IR-4, SI-2	BOD 26-04; KEV; Secure by Design VDP	AIVSS; SAMM Incident Mgmt	EU AI Act incident reporting	VM and patch automation, remediation ops, AI incident playbooks

P3 Data & model sourcing: separate phase; contains 218A PW.3, PS.1.2, PS.1.3, CISA AI Data Security, LLM04 and ASI06.
Agent and MCP identity: placed in P2 (design). Government sources: CISA agentic guidance (May 2026), SP 800-207A. NCCoE agent identity: concept paper (Feb 2026). COSAiS agent overlays: no draft.

04Security tool coverage catalog

69 capabilities, domains A–J.
Filters: keyword, maturity, new vs extend, priority.
D1 (adversarial testing): detailed in doc 2.

capabilities, 10 domains

New tool categories; 29 Extend

P1 (next 12 months)

Gap maturity (no mature product category)

Maturity: Mature several products · Emerging products under 3 years old or consolidating · Gap DIY or immature OSS.
New / Extend: New new tool category · Extend existing control extended to AI assets.
Priority: P1 next 12 months · P2 12–24 months · P3 opportunistic.

ID	Capability	Threat / purpose	Phase	Framework anchors	Representative vendors / OSS	Maturity	New / Extend	Priority
A · Developer endpoint & IDE
A1	IDE extension allowlisting & private marketplace	Malicious or hijacked VS Code/Open VSX extensions (GlassWorm). Cursor and Windsurf use Open VSX.	P4	SSDF PO.3, PO.5; 800-53 CM-7; ASI04	Microsoft VS Code Private Marketplace + `extensions.allowed`; Palo Alto (Koi) Agentic Endpoint Security; Socket (Secure Annex)	Emerging	New	P1
A2	Extension, plugin & agent-skill reputation scanning	Unscanned agent skills, plugins and rules-file packs; transitive extension dependencies	P4	ASI04; MCP04; CICD-SEC-3	Socket; Palo Alto (Koi); StepSecurity Dev Machine Guard	Gap	New	P1
A3	AI coding-assistant policy enforcement	Uncontrolled agent permissions, auto-run, unapproved MCP servers and models on developer machines	P4	ASI02, ASI03; CISA agentic guidance (least privilege)	Claude Code managed settings / managed MCP; GitHub Copilot enterprise policy; Cursor enterprise; delivered by MDM	Emerging	New	P1
A4	Repo-borne prompt-injection scanning	Hidden instructions in `AGENTS.md`, `.cursorrules`, issues and docs feeds that hijack coding agents (rules-file backdoor, ContextCrush)	P4	LLM01; ASI01; MCP06	Pillar (AI coding agents); Snyk agent-scan; custom Semgrep rules	Gap	New	P1
A5	Package firewall / curated registry proxy	Developers pulling packages straight from npm/PyPI; worm-propagated malware (Shai-Hulud)	P4–P5	SSDF PW.4; 800-53 SR-3, SR-11; CICD-SEC-3	JFrog Curation; Sonatype Repository Firewall; Socket Firewall (`sfw`); Chainguard Libraries	Mature	Extend	P1
A6	Block direct internet software downloads & app allowlisting	Unvetted binaries, CLIs, model files and AI desktop apps installed from the internet	P4	800-53 CM-7(5), CM-11; SSDF PO.5	macOS: Santa / Jamf Protect; Windows: App Control for Business (WDAC); EDR application control; SSE download policy (Zscaler, Netskope)	Mature	Extend	P2
A7	Pre-commit secret scanning	API keys (especially AI provider keys) committed to repos; harvested by worms	P4	SSDF PS.1; CICD-SEC-6; MCP01	gitleaks; GitGuardian ggshield; TruffleHog; GitHub push protection	Mature	Extend	P1
A8	IDE / pre-commit SAST	Vulnerable code from humans and AI assistants caught before review	P4	SSDF PW.7; ASVS	Semgrep; Snyk; Endor Labs AURI (MCP to agents); GitHub Copilot Autofix	Mature	Extend	P2
A9	Endpoint AI agent & local MCP inventory	Shadow MCP servers over stdio bypass network gateways; unknown AI clients	P4, P8	MCP09; ASI04	Runlayer AI Watch; Noma endpoint; StepSecurity Dev Machine Guard; Snyk agent-scan	Emerging	New	P1
A10	Developer credential hardening	Long-lived tokens in `~/.npmrc`, `.env` and cloud CLIs; AI keys exfiltrated by s1ngularity-style payloads	P4	CICD-SEC-6; 800-53 IA-5	1Password / Vault dev secrets; short-lived SSO-backed CLI credentials; Aembit	Mature	Extend	P1
A11	Isolated dev environments for coding agents	Coding agents running with full laptop privileges and network access	P4	ASI05; CISA agentic guidance	Dev containers / GitHub Codespaces; E2B; Daytona; agent sandbox modes	Emerging	New	P2
B · Code, composition & artifacts
B1	SAST incl. AI-native code review	Logic and authorization flaws in high-volume AI-generated code	P4–P6	SSDF PW.7; 800-53 SA-11	Semgrep; Snyk; Checkmarx; Veracode; GitHub CodeQL; Corgea; DryRun; OpenAI Codex Security	Mature	Extend	P1
B2	Secrets scanning (history + push protection)	Secrets across repo history, CI logs and container layers	P4–P5	CICD-SEC-6; MCP01	GitHub Secret Protection; GitGuardian; TruffleHog	Mature	Extend	P1
B3	SCA with reachability	Known-vulnerable dependencies; triage overload from AI-scale CVE volume	P5	SSDF PW.4, RV.1; 800-53 RA-5	Endor Labs; Snyk; Socket (Coana); GitHub Dependabot; Aikido	Mature	Extend	P1
B4	Malicious package detection	Typosquats, account takeovers, self-propagating worms	P4–P5	CICD-SEC-3; SR-11	Socket; JFrog Xray; Sonatype; Veracode (Phylum)	Mature	Extend	P1
B5	OSS inclusion & license policy	Unapproved OSS and model licenses (including model weights' terms of use)	P1, P5	SSDF PW.4; SCVS V5	Sonatype; FOSSA; Snyk; Black Duck	Mature	Extend	P2
B6	SBOM generation & management	Inventory and continuous vulnerability matching; CISA 2026 minimum elements	P5, P9	SSDF PS.3.2; CISA 2026 SBOM; SCVS V2	Syft/Grype (Anchore); cdxgen; OWASP Dependency-Track	Mature	Extend	P1
B7	AIBOM / ML-BOM	Inventory of models, datasets, adapters, prompts, MCP servers and agent configs	P3, P5	218A PS.3.2; CISA/G7 AI SBOM; CycloneDX ML-BOM; SPDX 3.0 AI	Cisco AI Defense (AI BOM); Snyk Evo AI-BOM; Mindgard; Cranium; Wiz AI-SPM	Gap	New	P2
B8	Model file scanning & model signing	Pickle / serialization payloads, backdoored or swapped weights from public hubs	P3, P5	218A PS.1.3; Deploying AI Systems Securely; LLM03	Prisma AIRS AI Model Security (Protect AI Guardian); HiddenLayer; JFrog AI Catalog; ModelScan; picklescan; OpenSSF model-signing	Emerging	New	P1
B9	Dataset provenance & poisoning checks	Poisoned training, fine-tuning or RAG corpora; split-view poisoning	P3	218A PW.3.1–3.3; CISA AI Data Security; LLM04; ASI06	DSPM (Cyera, Varonis) for stores; mostly custom pipelines	Gap	New	P2
B10	Container & artifact scanning; hardened images	Vulnerable base images and model-serving containers	P5	SSDF PW.4; 800-53 RA-5	Chainguard Images; Echo (Minimus); Wiz; Prisma Cloud; Grype	Mature	Extend	P1
B11	IaC scanning	Misconfigured cloud, GPU and AI services as code	P4–P5	SSDF PW.9; 800-53 CM-6	Checkov; Trivy; KICS (KICS and Trivy compromised by TeamPCP, Feb–Mar 2026)	Mature	Extend	P2
B12	AI-generated code governance	Provenance of AI-authored changes; review policy; agent-authored PRs	P4	SSDF PO.1; PW.7	Apiiro; Legit; GitHub rulesets; agent commit attribution	Emerging	New	P2
C · Pipeline (CI/CD) security & observability
C1	CI/CD posture & workflow scanning	`pull_request_target` abuse, unpinned actions, over-scoped tokens	P5	CICD-SEC-1, 4, 5, 7; Scorecard	zizmor; OpenSSF Scorecard; StepSecurity; Cycode; Legit	Mature	Extend	P1
C2	Runner hardening & egress control	Secret exfiltration from runners (tj-actions); cache poisoning	P5	SP 800-204D; CICD-SEC-6, 10	StepSecurity Harden-Runner; ephemeral self-hosted runners	Emerging	Extend	P1
C3	Build provenance & signing	Tampered artifacts; OIDC trusted publishing abused by Mini Shai-Hulud	P5	SLSA v1.2; SSDF PS.2, PS.3; 800-53 SR-4	Sigstore; GitHub artifact attestations; npm/PyPI trusted publishing; in-toto	Mature	Extend	P1
C4	Deploy-time admission verification	Unsigned or unprovenanced images and models reaching production	P7	SSDF PS.2; CM-14; SLSA verify	Kyverno; OPA Gatekeeper; Sigstore policy-controller	Mature	Extend	P2
C5	Pipeline secrets & OIDC federation	Long-lived cloud and registry credentials in CI	P5	CICD-SEC-6; 800-53 IA-5	OIDC to cloud; Vault; GitHub environments	Mature	Extend	P1
C6	Governance of AI agents inside CI	Prompt injection through PR or issue text into Claude Code Action / Copilot agent, reaching secrets	P5	ASI01, ASI02; CICD-SEC-4	Least-privilege tokens + Harden-Runner; no dedicated product yet	Gap	New	P1
C7	Artifact, model & MCP registry governance	Ungoverned binaries, models and MCP servers entering builds	P3, P5	SSDF PS.3; SCVS V4	JFrog Artifactory + AI Catalog + MCP Registry; Sonatype Nexus; Hugging Face Enterprise Hub	Emerging	Extend	P2
C8	ASPM / risk correlation	Too many findings across too many tools; no code-to-runtime context	P5–P9	SAMM Defect Mgmt	Apiiro; Cycode; ArmorCode; Legit; Snyk Evo	Mature	Extend	P3
C9	Pipeline audit & observability	No forensic trail for pipeline compromise	P5, P8	CICD-SEC-10; 800-53 AU-2	SCM audit logs to SIEM; StepSecurity; Cribl	Mature	Extend	P2
D · Adversarial testing & verification
D1	AI adversarial testing / red teaming	Prompt injection, jailbreak, data exfiltration, tool misuse and goal hijack in LLM apps and agents before release, plus regression on every change	P6, P8	AI RMF MEASURE 2.7; 218A PW.3.3; CAISI; OWASP AI Testing Guide; GenAI Red Teaming Guide; LLM Top 10; ASI Top 10	See doc 2: Pillar, Straiker, Mindgard, Repello, Prisma AIRS, Zscaler (SPLX), F5, Cisco; OSS promptfoo, PyRIT, garak, DeepTeam	Emerging	New	P1
D2	Model evaluation (safety, bias, robustness)	Model selection and model swaps change risk	P3, P6	AI RMF MEASURE 2.3–2.11; AI 600-1	Inspect (UK AISI); Giskard; Holistic AI; Arize (Dynatrace); Galileo (Cisco)	Emerging	New	P2
D3	DAST / API security testing	Classic web and API flaws around the AI app (authz, SSRF, injection)	P6	SSDF PW.8; ASVS	Burp Suite; StackHawk; Invicti; Salt Security; Akamai API Security	Mature	Extend	P1
D4	MCP server dynamic testing & fuzzing	Command injection, auth flaws and rug pulls in MCP servers	P3, P6	MCP03, MCP05, MCP07	Enkrypt (Anaconda) MCP scan; Cisco MCP Scanner; mcplint / mcpfuzz (immature)	Gap	New	P2
D5	AI-assisted pentest & exploit validation	Exploitability validation; false-positive reduction	P6, P9	800-53 CA-8; RA-5	XBOW; Codex Security; Mythos-class programs (partner-gated)	Emerging	New	P3
E · Cloud & infrastructure posture
E1	CNAPP / CSPM / KSPM	Cloud misconfiguration and toxic combinations	P7–P8	800-53 CM-6, RA-5	Wiz (Google); Cortex Cloud (Palo Alto); Orca; Microsoft Defender for Cloud; Upwind; Sysdig	Mature	Extend	P1
E2	AI-SPM	Exposed model endpoints, vector DBs and Bedrock/Vertex/Foundry agents; over-permissioned AI identities	P7–P8	AI RMF MAP 4.1; MCP09	Wiz AI-SPM; Cortex Cloud AI-SPM; Orca; Defender for Cloud / Agent 365	Emerging	New	P1
E3	GPU & model-serving infrastructure hardening	Container escape on shared GPUs (NVIDIAScape), exposed Ray/vLLM/Triton, KV-cache leakage	P7–P8	800-53 SC-39, SI-2	CNAPP runtime agents + vendor patching; no dedicated category	Gap	New	P2
E4	DSPM for AI data stores	Sensitive data in training sets, RAG indexes and prompt logs	P3, P8	CISA AI Data Security; LLM02	Cyera; Varonis; Sentra; Wiz DSPM	Emerging	Extend	P2
F · Runtime AI security
F1	AI firewall / guardrails	Prompt injection, jailbreaks, PII and secret leakage, toxic output at runtime	P7–P8	LLM01, 02, 05; AI RMF MANAGE 2.x	Prisma AIRS; Check Point AI Guardrails (Lakera); Cisco AI Defense; F5 AI Guardrails; CrowdStrike Falcon AIDR; Cloudflare Firewall for AI; NeMo Guardrails; Llama Guard / Prompt Guard	Emerging	New	P1
F2	LLM / AI gateway	Central routing, keys, rate and cost limits, logging, model allowlist	P7–P8	LLM10; MCP08	Portkey (Palo Alto); Kong AI Gateway; Cloudflare AI Gateway; LiteLLM (compromised by TeamPCP, Feb–Mar 2026)	Emerging	New	P1
F3	Shadow AI & workforce AI usage control	Sensitive data pasted into unsanctioned AI apps; unknown AI SaaS	P8	AI RMF GOVERN 6.1; LLM02	SentinelOne (Prompt Security); Harmonic; WitnessAI; Akamai (LayerX); Island; Netskope; Zscaler; Cato (Aim)	Emerging	New	P1
F4	RAG / vector store access control	Cross-tenant retrieval, embedding inversion, permission-unaware retrieval	P2, P7	LLM08; ASI06	Permission-aware retrieval in app code; OpenFGA / Cedar; Pinecone / Weaviate RBAC	Gap	New	P2
G · MCP, gateway & tool governance
G1	MCP gateway / proxy	Unauthenticated tools, no audit, no central allow/deny	P7–P8	MCP02, 07, 08, 09; ASI02	Docker MCP Gateway; Cloudflare MCP Server Portals; Kong; agentgateway (LF); IBM ContextForge; Microsoft MCP Gateway; Runlayer; Obot; Lasso; Operant	Emerging	New	P1
G2	Private MCP registry & server vetting	Typosquatted or malicious servers (postmark-mcp); unvetted community servers	P3, P7	MCP04; ASI04	JFrog MCP Registry; Docker MCP Catalog; Cisco MCP Catalog; official MCP Registry (subregistry)	Emerging	New	P1
G3	MCP tool-description scanning & pinning	Tool poisoning; rug pulls (description changes after approval)	P3, P8	MCP03, MCP06	Snyk agent-scan; Cisco MCP Scanner; Enkrypt	Emerging	New	P1
G4	Fine-grained tool-call authorization	Agent calls a permitted tool with harmful arguments or resources	P2, P7	ASI02, ASI03; MCP02	Cedar; OpenFGA; Permit.io; Oso; Cerbos (mostly DIY today)	Gap	New	P1
H · Agentic workload security
H1	Agent & workload identity	Agents sharing human or service credentials; no attribution	P2, P7	SP 800-207A; NCCoE agent identity; ASI03	SPIFFE/SPIRE; Microsoft Entra Agent ID; Okta for AI Agents; Aembit; Astrix (Cisco)	Emerging	New	P1
H2	On-behalf-of (delegated) authorization	Confused deputy; agents exceed the invoking user's rights	P2, P7	RFC 8693 token exchange; ID-JAG (draft); ASI03	Okta Cross App Access (GA Aug 2026); Auth0 for AI Agents; Descope; Entra OBO	Emerging	New	P1
H3	Secretless credential brokering	Static API keys in agent configs and prompts	P7	MCP01; CICD-SEC-6	Aembit; Auth0 Token Vault; Vault dynamic secrets	Emerging	New	P2
H4	Human-in-the-loop approval for high-impact actions	Irreversible agent actions without consent; human trust exploitation	P2, P7	ASI09; CISA agentic guidance	OAuth CIBA (Auth0, Descope); framework interrupts (LangGraph, OpenAI Agents SDK)	Emerging	New	P1
H5	Agent observability & tracing	No evidence trail of prompts, tool calls and decisions	P8	MCP08; AI RMF MANAGE 4.1; OTel GenAI semconv (still in development)	Langfuse; Arize (Dynatrace); LangSmith; Datadog LLM Obs; OTel	Emerging	New	P1
H6	Agent detection & response (AIDR)	Goal hijack, rogue agents and anomalous tool chains at runtime	P8	ASI01, ASI08, ASI10	Zenity; Noma; Straiker Defend AI; Operant; Pillar; Lasso; CrowdStrike Falcon AIDR	Emerging	New	P1
H7	Sandboxed code & tool execution	Agent-generated code runs with host privileges (ASI05)	P7–P8	ASI05; LLM05	E2B (Firecracker); Modal (gVisor); Northflank; Cloudflare Sandbox; gVisor / Kata / Firecracker	Emerging	New	P1
H8	Agent egress control	Exfiltration through tool calls, markdown images and URL fetches	P7–P8	LLM02; ASI02	SSE / SWG egress policy; sandbox network policy; MCP gateway	Gap	New	P1
H9	Agent inventory & AgBOM	Agent sprawl across SaaS copilots, frameworks and endpoints	P0, P8	OWASP Agent Control Standard; MCP09	Microsoft Agent 365; Zenity; Noma; ServiceNow AI Control Tower	Emerging	New	P1
I · Infrastructure defense
I1	Network defense, segmentation & NDR	Lateral movement from compromised agents and inference hosts	P8	SP 800-207; 800-53 SC-7, SI-4	Zscaler / Palo Alto / Cloudflare ZT; Illumio; Darktrace; Vectra; ExtraHop	Mature	Extend	P2
I2	Risk-based vulnerability management	AI-scale CVE volume; prioritization by exposure and KEV	P9	BOD 26-04; KEV; 800-53 RA-5	Tenable; Qualys; Rapid7; CrowdStrike Exposure Mgmt	Mature	Extend	P1
I3	Patch automation & remediation ops	About 5-day time-to-exploit against a 361-day median to remediate half of exposed vulns	P9	SSDF RV.2; 800-53 SI-2	Automox; Vicarius vRx; Zafran; Seemplicity; Aikido (Root) backports	Emerging	Extend	P1
I4	EASM & AI-driven external threat monitoring	Exposed AI endpoints, leaked AI keys, brand and agent impersonation	P8	800-53 RA-5(11), SI-4	CrowdStrike; Palo Alto Cortex Xpanse; Censys; SecurityScorecard; Infoblox	Mature	Extend	P2
I5	AI deception: honeypots & honeytokens	Detect hijacked agents and AI-driven attackers by planting decoy tools, MCP servers and credentials	P8	MITRE Engage; ATLAS	Thinkst Canary; Acalvio Deception Guardrails; Tracebit; Beelzebub (OSS LLM/MCP honeypot); Galah	Gap	New	P2
I6	AI SOC & anomaly detection	Alert volume; machine-speed attacks	P8–P9	800-53 IR-4, SI-4	Dropzone; Prophet; Torq; Exaforce; 7AI; Darktrace; Vectra	Emerging	New	P2
I7	AI-powered vulnerability discovery (defender use)	Defender-side AI vulnerability discovery	P6, P9	SSDF RV.1	Google Big Sleep / CodeMender; XBOW; Codex Security; Project Glasswing (partner-gated)	Emerging	New	P3
J · AI governance & posture
J1	AI inventory & risk tiering	Unknown models, agents and AI vendors; inventory drift	P0	AI RMF GOVERN; ISO 42001; M-26-05 inventory	Credo AI; Cranium; OneTrust; ServiceNow AI Control Tower; Varonis (AllTrue)	Emerging	New	P1
J2	Regulatory control mapping	EU AI Act, NIST AI RMF and ISO 42001 evidence	P0	EU AI Act; ISO 42001 / 42005	Credo AI; Holistic AI; OneTrust	Emerging	New	P2
J3	AI vulnerability scoring & AI incident response	CVSS does not capture agentic impact; no AI playbooks	P9	OWASP AIVSS; AI RMF MANAGE 4.3	AIVSS calculator; SOAR playbooks	Gap	New	P2
J4	Third-party AI / model provider risk	AI features embedded in SaaS; model provider terms and data use	P1	AI RMF GOVERN 6.1; 218A PO.1.3	TPRM suites (OneTrust, Whistic) + AI questionnaires	Emerging	Extend	P2

05Funding sequence

Horizon	Fund	Basis
0–6 months	A1/A3/A9 endpoint AI and extension control · A5 package firewall · C1/C2/C6 CI hardening · D1 adversarial testing · G1/G2/G3 MCP gateway, registry and scanning · F3 shadow AI · H5 agent tracing	Incidents in §01: developer endpoints (GlassWorm, Mini Shai-Hulud, s1ngularity), CI (HackerBot-Claw, prt-scan), tool layer (postmark-mcp, ContextCrush).
6–12 months	H1/H2 agent identity + OBO · G4 tool-call authorization · H6 AIDR · H7 sandboxes · F1/F2 runtime guardrails + gateway · E2 AI-SPM · B8 model scanning · I3 patch automation	Depends on 0–6 month inventory and testing. Okta Cross App Access GA Aug 2026; Entra Agent ID GA May 2026.
12–24 months	B7 AIBOM · B9 dataset provenance · D4 MCP fuzzing · E3 GPU hardening · I5 AI deception · J3 AIVSS-based response	Maturity: Gap (B7, B9, D4, E3, I5, J3). Pending standards: AIVSS 1.0 (current v0.8), COSAiS agent overlays (no draft).

06OWASP LLM Top 10: 2025 → 2026 crosswalk

2025 ID	2025 name	2026 ID	2026 name
LLM01	Prompt Injection	LLM01	Prompt Injection
LLM02	Sensitive Information Disclosure	LLM02	Sensitive Information Disclosure
LLM03	Supply Chain	LLM04	Supply Chain
LLM04	Data and Model Poisoning	LLM05	Data and Model Poisoning
LLM05	Improper Output Handling	LLM10	Improper Output Handling
LLM06	Excessive Agency	LLM03	Excessive Agency
LLM07	System Prompt Leakage	LLM08	Hidden Context Exposure (renamed, broader scope)
LLM08	Vector and Embedding Weaknesses	LLM09	Vector and Embedding Weaknesses
LLM09	Misinformation	LLM07	Misinformation
LLM10	Unbounded Consumption	LLM06	Unbounded Consumption

2026 edition: published August 2026; rankings weighted partly on incident data.
IDs used in these docs: 2025 edition, the IDs vendor tooling maps to.