AI security best practices: a framework-based checklist (NIST + OWASP)

Autonomous AI agents are now probing enterprise environments, chaining  permissions, and moving laterally without a human in the loop. Traditional security frameworks such as NIST CSF and ISO 27001 were not built for that speed or for autonomous threat  actors. NIST’s AI Risk Management Framework (AI RMF) and OWASP’s Top 10 for LLM Applications were published to close that gap. This document provides an actionable roadmap from what those frameworks require to the controls that satisfy them.

At a glance

• NIST AI RMF and OWASP Top 10 for LLM Applications both treat runtime detection as a core AI security control, not an optional add-on.
• Many AI security programs have established strong governance and access controls, leaving runtime detection as the logical next area to mature.
• OWASP’s top AI risks, including prompt injection and excessive agency, need continuous monitoring since preventive controls alone cannot catch them in production.
• Deception-based detection gives the behavior-independent signal that NIST’s Manage function and OWASP’s detection guidance call for.
• Acalvio 360 Deception maps to approximately 20 MITRE ATT&CK techniques and seven of the eight MITRE Engage tactics.

The NIST AI Risk Management Framework (AI RMF) organizes AI security into four continuous functions: Govern, Map, Measure, and Manage. Together, they provide a lifecycle for identifying, assessing, and reducing AI risk. While many organizations focus on governance and inventory, the Manage function is often the weakest. It requires organizations to continuously monitor AI systems in production, detect attacks as they occur, and respond before damage spreads.

Table 1: NIST AI RMF functions and their security objectives

Many organizations already perform portions of the first three functions through existing governance, identity, and risk management programs. The greatest gap typically appears in Manage, where runtime monitoring and threat detection are essential. As AI agents operate autonomously and make decisions using legitimate credentials, organizations need continuous visibility into their behavior to detect misuse before it escalates.

Identity security addresses one layer of AI risk. The OWASP Top 10 for Large Language Model Applications addresses another by translating common generative AI risks into practical security controls for development and deployment.

The OWASP Top 10 for LLM Applications highlights several risks that cannot be eliminated through preventive controls alone. 

• LLM01: Prompt Injection occurs when malicious instructions manipulate an AI model into performing unintended actions despite existing guardrails. 
• LLM06: Excessive Agency warns that AI agents granted broad permissions may execute unauthorized workflows or access systems beyond their intended purpose.
• LLM08: Vector and Embedding Weaknesses focuses on attacks that poison retrieval data or manipulate the knowledge sources AI systems rely on. 
• LLM09: Misinformation addresses situations where compromised or manipulated inputs cause models to produce inaccurate or misleading outputs.

360 Deception addresses OWASP LLM06: Excessive Agency effectively by placing Honeytokens along AI-accessible paths, generating high-confidence alerts when an agent operates beyond its authorized scope. 

Preventive controls such as input validation, least-privilege access, and model testing reduce risk but cannot stop every attack. Combined with continuous runtime monitoring and deception-based detection, they help organizations meet OWASP’s operational objectives while reducing AI risk throughout deployment and operations.

The following 12-point AI security checklist  translates guidance from the NIST AI Risk Management Framework (AI RMF) and the OWASP Top 10 for LLM Applications into practical security controls. Organized by security function, it provides a concise framework for reducing AI risk across the entire lifecycle.

Effective AI security requires more than implementing best practices. It also requires validating that those controls detect and disrupt real-world attacker behavior. 360 Deception aligns with approximately 20 MITRE ATT&CK techniques, including T1078 (Valid Accounts), T1087 (Account Discovery), T1021 (Remote Services), and T1558 (Steal or Forge Kerberos Tickets), with additional mappings varying by deployment and attack path. 

360 Deception also supports seven of the eight MITRE Engage tactics, extending coverage beyond ATT&CK’s attack taxonomy to the industry’s leading framework for adversary engagement. Together, these mappings demonstrate that 360 Deception is built on established security frameworks that help organizations detect, validate, and respond to AI-driven attacks with high confidence.

1. Stopping at “Audit-Ready” Rather Than “Battle-Ready” 

Meeting the requirements of frameworks such as the NIST AI RMF or the OWASP Top 10 is only the beginning. These frameworks define security objectives, but organizations still need operational controls to detect and respond to attacks in production.

2. Stopping at Policy and Access Control Without Runtime Visibility 

While strong policies and access controls define what AI systems should do, they cannot monitor what AI agents are actually doing in production. AI security requires pairing pre-runtime governance with active, real-time detection to identify unauthorized tool execution and dynamic threats. 

3. Deploying Detection Tools Without Mapping the AI Attack Surface 

Security tools, whether existing platforms or new AI-specific capabilities, are only effective when aligned to where AI risk actually lives. Without mapping agent workflows, machine identities, APIs, and data paths, organizations risk creating monitoring blind spots or generating disconnected alerts that don’t cover the full AI execution path. 

4. Treating Runtime Detection as an Isolated Operational Silo 

Runtime detection and high-fidelity deception signals deliver the most value when wired directly into existing SIEM, SOAR, and incident response playbooks. Without seamless integration, security teams miss out on low-noise alerts, slowing down automated containment and increasing response times.