Defend zee clankers - OWASP AI Security Verification Standard AISVS

This lightning talk introduces version 1.0 of the OWASP AI Security Verification Standard (AISVS), an open standard of about 190 numbered, testable requirements. The speakers say it was built in the style of OWASP's ASVS, with a developer audience first and assessors second. Requirements were drafted publicly on GitHub, with many community contributions that the leadership team reviewed line by line. The standard covers the AI lifecycle in 12 chapters, including training data integrity, input validation, model lifecycle and change control, access control, supply chain, runtime behavior, memory and vector stores, agentic orchestration and MCP, adversarial robustness, and monitoring.

The talk explains the three verification levels. Level one is a baseline for any AI-enabled feature, level two is the recommended target for production systems that handle real user or business data, and level three suits high-assurance settings such as regulated workloads and safety-critical decisions. Teams should choose a level based on the impact of failure. The speakers placed AISVS beside the OWASP LLM Top 10, MITRE ATLAS, and the NIST AI RMF, describing it as the technical verification layer that complements those resources. Governance requirements were deliberately removed. Chapter 9, on agentic high-impact action approval, was presented as the most contentious area, particularly the role of human review.

The closing guidance was practical. Teams can check design documents against the requirements, use the chapter pages as prompts for AI-assisted gap analysis of their codebases, add the controls to coding-agent instructions, and assess AI products before purchase. Requirement numbers stay stable across 1.x releases so findings remain valid, and the speakers expect substantial revisions in a future 2.0.