Free resource
The AI/LLM deployment checklist.
Ten checks, one per OWASP LLM Top 10 category, written as something you can actually verify before shipping, not a restatement of the theory.
Free to use. No signup. Save this page, print it (it's formatted to print cleanly), or link straight to it from your launch checklist.
Prompt injection
Anything the model reads that didn't come directly from the current user (a document, a ticket, a scraped page, a tool result) is treated as untrusted data, never as an instruction. Verify this by testing what happens when that content contains an instruction.
Sensitive information disclosure
The model or agent cannot surface another user's or tenant's data through a normal-looking request. Test with a prompt that asks, directly or indirectly, for information outside the current user's scope.
Supply chain
Every third-party model, plugin, fine-tune, or embedding you depend on is named, versioned, and has an owner who'd notice if it changed underneath you.
Data and model poisoning
Any data used for fine-tuning or retrieval has a known source and an integrity check, so a manipulated input can't quietly bias or backdoor future outputs.
Improper output handling
Model output is validated, sanitized, and permission-checked exactly like any other untrusted input before it's rendered, executed, or used to call another system.
Excessive agency
Every tool the agent can call runs with the permissions of the user who triggered the session, not a shared service credential. Read the full guide: why your AI agent shouldn't run with the company's service account.
System prompt leakage
Nothing security-relevant (credentials, internal URLs, access rules) lives only in the system prompt. Assume it will eventually be recoverable and design accordingly.
Vector and embedding weaknesses
Retrieval-augmented generation queries are scoped by tenant at the vector store level, not filtered after the fact, and ingested documents can't inject instructions into future retrievals.
Misinformation
Any output presented as fact in a workflow with real consequences (billing, compliance, medical, legal) is either verified against a source or clearly flagged as generated and unverified.
Unbounded consumption
Rate limits, token ceilings, and cost alerts exist per user and per tenant, so a single account can't exhaust the shared budget or take the service down for everyone else.
Want these checked properly
A checklist tells you what to look for. A review tells you what's actually true.
The AI/LLM threat model engagement runs every item above against your real architecture, checked against MITRE ATLAS and the current OWASP LLM Top 10.