Every lab in the catalog references the frameworks below where relevant. Descriptions are kept short and factual — for the authoritative detail, follow the link to each framework's own publisher. Exact control-ID mappings are marked "to be validated" on individual labs until confirmed.
OWASP GenAI Security Project
A community-maintained list of the most critical security risks in applications built on large language models, covering prompt injection, insecure output handling, data disclosure and related issues.
Visit source →OWASP GenAI Security Project
A companion list from the same OWASP project, covering the ten most critical risks specific to autonomous, tool-using AI agents — excessive agency, tool misuse, unsafe delegation and multi-agent trust issues.
Visit source →U.S. National Institute of Standards and Technology
A voluntary framework for managing risks in the design, development and use of AI systems, organized around Govern, Map, Measure and Manage functions.
Visit source →MITRE
A knowledge base of adversary tactics and techniques against AI-enabled systems, modeled on the structure of MITRE ATT&CK.
Visit source →International Organization for Standardization
The international management-system standard for AI — governance, risk management and lifecycle controls for organizations that develop, provide or use AI systems.
Visit source →International Organization for Standardization
The international standard for information security management systems — the ISMS foundation that AI-specific controls should extend rather than duplicate.
Visit source →Saudi Data & Artificial Intelligence Authority
Saudi Arabia's national AI governance program, including AI Ethics Principles and AI-service-provider accreditation requirements administered by SDAIA.
Visit source →National Cybersecurity Authority (Saudi Arabia)
Saudi Arabia's baseline and cloud cybersecurity controls (ECC, CCC and related guidance), including guidance the NCA has been developing on AI-specific cybersecurity requirements.
Visit source →Tell me what is being decided and what is at stake. I will first say honestly whether my experience fits — then we talk about scope, not before.
Or connect on LinkedIn first.