🛡️ OWASP GenAI Data Security Initiative

Community-developed taxonomies, crosswalks, datasets, and tooling for securing data in generative and agentic AI systems.

Part of the OWASP GenAI Security Project · Initiative Page

🌐 Open the Crosswalk webapp  ·  🛡️ Get the DSGAI Scanner  ·  📄 Read the 2026 risk taxonomy

White Papers · Crosswalk · Scanner · Datasets · Contribute

---

🚀 Start here

The initiative ships three things you can use today: the risk taxonomy (white papers below), the Crosswalk webapp, and the DSGAI Scanner. The webapp and the scanner each have their own repository.

🌐 Framework Crosswalk

Map every OWASP GenAI risk to 26 frameworks, from NIST AI RMF and ISO/IEC 42001 to the EU AI Act and DORA. You can score your coverage, find gaps, and export OSCAL or STIX.

Open the webapp → Source and data: GenAI-Security-Project/crosswalk

🛡️ DSGAI Scanner

Audit a GenAI or agentic codebase against all 21 DSGAI controls. Findings are deterministic and SARIF-ready, and secrets never leave your machine. Use the free CLI in CI, or the Claude Code skill for a narrative report.

Get the scanner → pip install ./dsgai && dsgai audit .

---

Overview

The OWASP GenAI Data Security Initiative addresses the data security risks unique to Large Language Models, Generative AI, and Agentic AI systems. AI introduces new data surfaces — prompts, context windows, embeddings, vector stores, agent traces, tool payloads — and new failure modes — prompt-driven extraction, cross-session bleed, inference attacks, plugin data drains — that traditional data security frameworks no longer map cleanly onto.

This initiative produces community-developed, peer-reviewed guidance, interactive tooling, and open datasets to help organizations understand and address these challenges. All materials are released under CC BY-SA 4.0.

At a glance

Deliverable	What it is	Where
📄 DSGAI Risk Taxonomy 2026	21 GenAI data security risks with tiered mitigations	White paper
📄 Data Security Best Practices	Companion implementation guide	White paper
🌐 Framework Crosswalk	51 risk entries × 26 frameworks, 3,700+ control mappings, interactive webapp	Webapp · Repo
🛡️ DSGAI Scanner	Deterministic compliance scanner for AI codebases (SARIF, CI-ready)	Repo · Quick start
📊 Community Datasets	Exploits, vulnerabilities, test cases, incidents, traces	datasets/
✅ Data Validation	Schemas and checks for contributed data	data_validation/
📚 Literature Review	Categorized corpus of LLM-security research papers	literature/

---

📄 Key Deliverables

GenAI Data Security Risks and Mitigations 2026 (v1.0)

📄 Download PDF · Released March 2026

A comprehensive enumeration of 21 data security risks specific to GenAI systems, each with tiered mitigations (Foundational → Hardening → Advanced) for organizations at different maturity levels. This is not a Top 10 — it is a structured risk taxonomy following data as it moves through a GenAI system.

Cross-referenced to the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications 2026.

ID	Risk
DSGAI01	Sensitive Data Leakage
DSGAI02	Agent Identity & Credential Exposure
DSGAI03	Shadow AI & Unsanctioned Data Flows
DSGAI04	Data, Model & Artifact Poisoning
DSGAI05	Data Integrity & Validation Failures
DSGAI06	Tool, Plugin & Agent Data Exchange Risks
DSGAI07	Data Governance, Lifecycle & Classification for AI Systems
DSGAI08	Non-Compliance & Regulatory Violations
DSGAI09	Multimodal Capture & Cross-Channel Data Leakage
DSGAI10	Synthetic Data, Anonymization & Transformation Pitfalls
DSGAI11	Cross-Context & Multi-User Conversation Bleed
DSGAI12	Unsafe Natural-Language Data Gateways (LLM-to-SQL/Graph)
DSGAI13	Vector Store Platform Data Security
DSGAI14	Excessive Telemetry & Monitoring Leakage
DSGAI15	Over-Broad Context Windows & Prompt Over-Sharing
DSGAI16	Endpoint & Browser Assistant Overreach
DSGAI17	Data Availability & Resilience Failures in AI Pipelines
DSGAI18	Inference & Data Reconstruction
DSGAI19	Human-in-the-Loop & Labeler Overexposure
DSGAI20	Model Exfiltration & IP Replication
DSGAI21	Disinformation & Integrity Attacks via Data Poisoning

Each entry follows a consistent structure: attack scenario in GenAI-specific terms, attacker capabilities, impact, and tiered mitigations with scope annotations (Buy / Build / Both).

LLM and GenAI Data Security Best Practices 2025 (v1.0)

📄 Download PDF · Released February 2025

The companion implementation guide covering data security principles, secure deployment architectures, monitoring and auditing guidelines, governance models, and future trends. Topics include data minimization, encryption strategies, access control for LLM pipelines, securing data flows in LLM agents, and regulatory compliance alignment.

---

🌐 Framework Crosswalk

The initiative's flagship interactive deliverable: 51 risk entries across four OWASP source lists — LLM Top 10 2026, Agentic Top 10 2026, DSGAI 2026, and Agentic Skills Top 10 — mapped to 26 industry frameworks through 3,700+ individual control mappings, with 131 tracked AI security incidents.

🚀 Open the Crosswalk webapp

Feature	What it does
Score Your Coverage	Select your frameworks, see your GenAI risk coverage gaps, validate with Garak/PyRIT results
Explorer	Search and filter all 51 entries; view mapped controls across every framework
Coverage Matrix	Interactive 51 × 26 matrix — click any cell for the specific controls
Incidents	Real-world AI security incidents, filterable by severity, year, and layer
Submit a Standard	Propose any framework for automated mapping

Crosswalk source data, per-framework compliance gap reports (Markdown, CSV, JSON, OSCAL), and enterprise exports (STIX 2.1, OSCAL Component Definition) are maintained in the dedicated GenAI-Security-Project/crosswalk repository.

Frameworks covered:

• AI governance & regulation — NIST AI RMF 1.0 · ISO/IEC 42001 · EU AI Act · ENISA Multilayer Framework · AIUC-1 · CoSAI (candidate) · EU AI Act Code of Practice (candidate)
• Security management & compliance — ISO/IEC 27001 · NIST CSF 2.0 · SOC 2 · PCI DSS v4.0 · CIS Controls v8.1 · FedRAMP
• Threat modeling & adversarial — MITRE ATLAS · MAESTRO (CSA) · STRIDE · CWE/CVE
• Testing & verification — OWASP ASVS · OWASP AISVS 1.0 · OWASP AI Testing Guide
• Secure SDLC, identity & maturity — NIST SP 800-218A · OWASP SAMM · OWASP NHI Top 10
• OT/ICS & financial resilience — ISA/IEC 62443 · NIST SP 800-82 Rev 3 · DORA

---

🛡️ DSGAI Scanner

v0.3.0 · maintained in its own repo, GenAI-Security-Project/dsgai — audits GenAI and agentic codebases against all 21 DSGAI controls.

A deterministic engine owns the pattern matching — 107 PCRE rules run via ripgrep produce identical findings on identical input, so you get a reproducible compliance artifact rather than an LLM opinion. An optional Claude Code skill orchestrates the run and writes the narrative report.

• 🎯 Deterministic & reproducible — a compliance report you can diff; secrets never leave your machine
• 🌐 Multi-language — Python, JavaScript/TypeScript, Java, Kotlin, Go, plus credential coverage for C#, Rust, Ruby
• 🐛 CVE enrichment without hallucination — queries OSV (+ NVD for CVSS) per pinned dependency across 6 ecosystems
• 🧰 Meets your toolchain — SARIF 2.1.0 for GitHub Code Scanning, a Semgrep rule-pack export, and a gitleaks pack for pre-commit
• 💸 $0 CI path — the CLI needs only Python 3.10+ and ripgrep; no LLM, no account

git clone --depth 1 https://github.com/GenAI-Security-Project/dsgai
pip install ./dsgai
dsgai audit . --sarif DSGAI-scan.sarif --json-out DSGAI-scan.json

📋 Full sample report: a scan of the scanner's own vulnerable fixture app, with the compliance dashboard shown above.

See the scanner README for the full feature set, CI/CD integration, and the Claude Code skill. Scanner issues and pull requests go to that repo.

---

📊 Community Datasets

Open, community-contributed datasets for research, benchmarking, and security testing — every entry mapped to the DSGAI taxonomy and validated before merge. See datasets/ and CONTRIBUTING.md.

Dataset	Contents	Status
Exploit Dataset	Documented exploit techniques targeting LLM applications, keyed to MITRE ATLAS	✅ 59 entries
Vulnerability Dataset	Real-world CVEs affecting LLM applications	✅ 47 entries
Risk Assessment Dataset	Mapped risk assessments for LLM deployments	✅ 23 entries
Prompt Injection & Data Extraction Test Cases	Adversarial prompts and extraction techniques for red-teaming and regression testing	✅ 300+ cases
RAG Poisoning & Retrieval Integrity	Synthetic poisoning fixtures for testing vector store integrity and retrieval filtering	🌱 growing — contribute
Incident Dataset	Anonymized real-world GenAI data security incidents	🙋 seeking contributors
Agent Data Flow & Tool Exchange Traces	Sanitized traces of agent tool calls and plugin data exchanges (DSGAI06)	🙋 seeking contributors
Cross-Framework Mapping Dataset

Contributions to every dataset are validated by the schemas and checks in data_validation/ — see the setup guide.

---

🗺️ Repository Map

├── datasets/                ← community datasets (8 tracks, one entry per file)
├── data_validation/         ← JSON schemas + validation pipeline for contributions
├── literature/              ← categorized LLM-security literature corpus
├── CONTRIBUTING.md          ← contribution paths by role and workstream
└── SECURITY.md              ← vulnerability reporting policy

Sibling repositories

Repo	What lives there
GenAI-Security-Project/crosswalk	Crosswalk data, generators, gap reports, OSCAL/STIX exports, and the webapp source
GenAI-Security-Project/dsgai	The DSGAI Scanner: CLI, rules, fixtures, GitHub Action, and the Claude Code skill

---

🧭 Workstreams

#	Workstream	Focus
1	Data Collection	Open call for real-world vulnerability data and incident reports — submit via Slack or a GitHub issue
2	Framework Crosswalk	Mapping OWASP GenAI risk lists to industry frameworks — see the webapp and crosswalk repo
3	Risks & Best Practices	Research, authoring, and maintenance of the initiative's white papers
4	Community Datasets	Building the open datasets above — schemas, curation, review
5	Data Validation	Automated and peer-reviewed validation of all contributed data

---

🤝 AI Risk Database Collaboration

The initiative collaborates with leading AI risk authorities to consolidate efforts and avoid fragmented approaches to risk identification:

• MIT AI Risk Repository
• MITRE ATLAS
• NIST AI Risk Management Framework

Community members are encouraged to report new GenAI data security risks to these organizations as well as to this initiative.

---

🙌 How to Contribute

All contributions are welcome — from security practitioners, AI engineers, researchers, compliance professionals, and anyone working to secure GenAI systems.

• 💬 Slack: Join #team-genai-data-security-initiative on the OWASP Slack workspace · New to OWASP Slack? Join here
• 🧑‍💻 GitHub: Submit issues or pull requests — CONTRIBUTING.md has starting points for every role and experience level
• 🔒 Security: Report vulnerabilities via GitHub Private Vulnerability Reporting — see SECURITY.md · researchers are credited in SECURITY-THANKS.md
• ✉️ Contact: Reach out to Emmanuel Guilherme Junior (Initiative Lead) via Slack

---

🧩 OWASP GenAI Security Project — Initiatives

This initiative is one of several under the OWASP GenAI Security Project:

Initiative	Description	Link
Agentic App Security	Securing autonomous and agentic AI systems, including the Top 10 for Agentic Applications 2026	Initiative Page
AI Red Teaming & Evaluation	Methodology, benchmarks, and tools for adversarial testing of GenAI systems	Initiative Page
AI Security Solutions Landscape	Vendor-agnostic mapping of the GenAI security tooling ecosystem	Solutions Directory
AIBOM Generator	Open-source tool for generating AI Bills of Materials for supply chain transparency	Initiative Page
Data Security	GenAI data security risks, mitigations, best practices, and framework crosswalks (this initiative)	Initiative Page
Governance Checklist (COMPASS)	Cybersecurity and governance checklist for LLM and GenAI deployments	Resource Page
Secure AI Adoption	Center of Excellence guidance for safe, ethical, and secure organizational AI adoption	Initiative Page
Threat Intelligence	Research into LLM-enabled exploit generation and deepfake threat preparation	Initiative Page

---

🙏 Acknowledgments

Initiative Lead: Emmanuel Guilherme Junior

DSGAI Scanner: initiated by Emmanuel Guilherme Junior and Harish Ramachandran. Harish Ramachandran is the initial contributor; he wrote the original v0.1 Claude Code skill.

This initiative is made possible by the contributions of its authors, contributors, and reviewers from across the global AI security community. Thank you to everyone who has helped build and shape this community resource. Full contributor lists are included in each published document.

---

📜 License

All materials produced by this initiative are licensed under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0).

You are free to share and adapt the material for any purpose, including commercial, under the following terms: provide appropriate attribution including the project name and asset name, and distribute any derivative works under the same license.