Most security managers have run into the OWASP Top 10 for LLM Applications exactly once — usually in a slide an engineering team put together to justify a control it already wanted to build. That's a narrower read than the list deserves. It isn't a developer checklist. It's a framework for deciding which technical controls belong in an AI security program in the first place, and that's the angle AAISM Domain 3 actually tests it from.

What's Actually On the List

The 2025 edition reorganized the list more than a routine refresh — two categories were added outright, several others were merged or renamed, and the ranking shifted to reflect where real incidents were actually showing up. System Prompt Leakage was added after a run of cases where attackers extracted hidden instructions straight out of production chatbots, and Vector and Embedding Weaknesses was added as retrieval-augmented generation (RAG) architectures went from novel to standard. Sensitive Information Disclosure jumped from sixth place to second, and Supply Chain moved from fifth to third — both reordered to match where the 2025 working group saw risk concentrating in practice.

The ten categories, in order: Prompt Injection (crafted input, delivered directly or hidden in content the model processes, overrides intended behavior); Sensitive Information Disclosure (the model exposes personal data, credentials, or proprietary material in its output); Supply Chain (a third-party model, dataset, plugin, or package carries inherited risk); Data and Model Poisoning (manipulated training or fine-tuning data plants bias or a backdoor); Improper Output Handling (model output reaches a downstream system without validation); Excessive Agency (an AI system is granted more autonomy or permission than its task requires); System Prompt Leakage (hidden instructions or embedded secrets get extracted); Vector and Embedding Weaknesses (a RAG pipeline's retrieval layer leaks data or admits injected content); Misinformation (confidently wrong output a user over-trusts); and Unbounded Consumption (no ceiling on token, API, or compute use, opening the door to cost-driven denial of service).

Why this matters for AAISM: Few resources in the AAISM body of knowledge sit this evenly across two domains. The OWASP Top 10 for LLM Applications is named study material for Domain 3, tested there as a control-selection and architecture-judgment framework — but the same ten categories double as a Domain 2 threat-modeling resource for identifying AI-specific technical risk. A scenario question built around this list could plausibly come from either domain's angle, which is itself a useful reminder that AI security risk doesn't actually respect the exam's domain boundaries — the domains are a study structure, not a wall between concerns.

Domain 3: A Control-Mapping Tool

The exam distinction that trips people up here is the same one that matters on the job: a security manager's role with this list isn't to review the code that mitigates each risk, it's to confirm every category has an owned, assigned control somewhere in the architecture — and to know which control actually answers which risk. Improper Output Handling gets closed by downstream output validation; Excessive Agency gets closed by scoping an agent's permissions to the minimum its task needs; Vector and Embedding Weaknesses gets closed by access controls on the retrieval layer, not just on the model itself. The job is confirming the mapping exists and is owned, not implementing it.

Domain 2: A Threat-Modeling and Vendor Due-Diligence Resource

The same ten categories answer a different question when the hat changes from architecture reviewer to risk manager: not "is this covered?" but "what could actually go wrong here, and how likely is it?" That's the threat-modeling use case Domain 2 tests — walking through the list against a specific system or vendor relationship to identify which categories represent real exposure versus which don't apply. It also works as a structured vendor due-diligence checklist before signing with a third-party LLM provider: ask specifically about their Supply Chain (LLM03) posture and their Prompt Injection (LLM01) and System Prompt Leakage (LLM07) handling, rather than accepting a general security attestation at face value.

Excessive Agency is worth calling out as its own cross-domain theme: it's the same failure mode behind real incidents where an AI agent was handed more autonomy than its task warranted — see The AI That Hacked Another Company for a live example already covered on this site.

Want to go deeper on how this domain is tested on the AAISM exam? The AI Security Management Prep App covers this and 300 other practice scenarios, offline.

Explore the App — $9.99

Related Reading

For the full exam breakdown, see the AAISM Certification Study Guide. For a real-world Excessive Agency incident, see The AI That Hacked Another Company. For the Supply Chain angle applied to a vendor breach, see One Vendor, Three AI Breaches.

Sources

OWASP — Top 10 for LLM Applications (2025)
OWASP Foundation — OWASP Top 10 for Large Language Model Applications project page
Dest Cert — AAISM Domain 3 Explained: AI Technologies and Controls