OWASP LLM Top-10 coverage scorecard
Generated from the detectors your policy actually enables, per environment, not a static marketing claim.
Evidence & compliance
OWASP LLM Top-10 coverage, generated from your policy.
Not a claim in a datasheet. The scorecard is derived from the detectors your environment actually has enabled, so it changes when your policy changes, and it is exportable for questionnaires and CISO reviews.
Coverage scorecard · policy prod-v42 · env production6 full · 3 partial · 1 gap
| ID | Risk | Mapped detectors | Coverage | Status |
|---|---|---|---|---|
| LLM01 | Prompt Injection | jailbreak · retrieval_chunk_injection · tool_output_injection | Partial | |
| LLM02 | Sensitive Information Disclosure | pii · secrets · exfiltration · sensitive_business_data | Full | |
| LLM03 | Excessive Agency | excessive_agency · tools | Full | |
| LLM04 | Supply Chain | mcp_manifest_scanner · tools | Partial | |
| LLM05 | Data & Model Poisoning | retrieval_chunk_injection · memory_write_poisoning | Gap | |
| LLM06 | Unbounded Consumption | unbounded_consumption | Full | |
| LLM07 | Misinformation | hallucination · citation_integrity · numerical_consistency | Full | |
| LLM08 | Hidden Context Exposure | system_prompt_leakage · document_metadata_leakage | Partial | |
| LLM09 | Vector & Embedding Weaknesses | embedding_integrity · retrieval_chunk_injection | Full | |
| LLM10 | Improper Output Handling | structure · code_safety · malicious_url | Full |
Coverage reflects implemented detectors mapped to the OWASP Top 10 for LLM Applications (2026 edition). Partial entries indicate risks that ZNYX mitigates but which also depend on controls outside the runtime. LLM05 is a gap: training-data, fine-tune, and model-weight poisoning happen upstream of the runtime and are not addressed by a ZNYX control today.
Artifacts
What you can actually hand an auditor
Detector scorecards
Precision, recall, F1, AUROC, ECE, and per-language breakdowns for every detector in the bundle.
ISO 42001 model cards
Fairness and bias model cards plus judge audit events, formatted for AI-governance review.
Immutable audit trail
Every decision, policy version, and judge verdict written as an append-only event with retention controls.
- ISO 42001
- EU AI Act
- NIST AI RMF
- OWASP LLM Top 10
FAQ
OWASP LLM Top 10 questions
How the mapping is built, how coverage is scored, and what it is honest about.
The mapping covers all ten categories, LLM01 prompt injection through LLM10 improper output handling, but coverage is not uniform and the page says which is which. Coverage is expressed as a 0-100 score per category rather than a tick, because a category like insecure output handling is partly an application concern that no gateway can close on your behalf.
From the detectors and gates that actually fire for each category, weighted by whether the control is deterministic, ML-based, or judge-based, and measured against benchmark datasets rather than asserted. The score is exportable as evidence, which is the point of scoring it at all.
The 2026 edition of the OWASP Top 10 for LLM Applications, published August 2026. It renumbered most of the list and replaced System Prompt Leakage with the broader Hidden Context Exposure.
Yes, that is what it is for. The scorecard exports with the detector scorecards and model cards behind it, so an assessor can see not just which control was claimed but how it was measured.