Welcome to the go-to resource for broad AI security & privacy - over 200 pages of practical advice and references on protecting AI and data-centric systems from threats. This content serves as key bookmark for practitioners, and is contributing actively and substantially to international standards such as ISO/IEC and the AI Act through official standard partnerships. Through broad collaboration with key institutes and SDOs, the Exchange represents the consensus on AI security and privacy.
See the overview of AI projects at OWASP.

Our Content AI Security Overview         - About the AI Exchange         - Summary         - How to use this document         - Threats                 Highlight: Threat matrix         - Controls                 Highlight: Periodic table of threats and controls         - Risk analysis         - How about … Deep dive into threats and controls:         - 1. General controls                 1.1 Governance controls                 1.2 Data limitation                 1.3 Limit unwanted behaviour         - 2. Threats through use and controls         - 3. Development-time threats and controls         - 4. Runtime application security threats and controls AI security testing AI privacy References

---

Sponsors

---

Dimitri van Zantvliet, Director Cybersecurity, Dutch Railways:
"A risk-based, context-aware approach—like the one OWASP Exchange champions—not only supports the responsible use of AI, but ensures that real threats are mitigated without burdening engineers with irrelevant checklists. We need standards written by those who build and defend these systems every day."

Sri Manda, Chief Security & Trust Officer at Peloton Interactive:
“AI regulation is critical for protecting safety and security, and for creating a level playing field for vendors. The challenge is to remove legal uncertainty by making standards really clear, and to avoid unnecessary requirements by building in flexible compliance. I’m very happy to see that OWASP Exchgange has taken on these challenges by bringing the security community to the table to ensure we get standards that work.”