Practical briefings on AI security, audit and regulation.

The OWASP Top 10 for LLM Applications (2025 edition) is the most widely used reference for LLM application risk. In plain terms:

• LLM01 Prompt Injection: input, including hidden instructions in documents or web pages, changes what the model does.
• LLM02 Sensitive Information Disclosure: the application reveals personal data, secrets or confidential content.
• LLM03 Supply Chain: risk inherited from third-party models, datasets, plugins and libraries.
• LLM04 Data and Model Poisoning: manipulated training, fine-tuning or retrieval data skews behaviour.
• LLM05 Improper Output Handling: model output is trusted by downstream code, leading to injection or unsafe actions.
• LLM06 Excessive Agency: an agent has more tools, permissions or autonomy than its task needs.
• LLM07 System Prompt Leakage: instructions or secrets in system prompts are exposed.
• LLM08 Vector and Embedding Weaknesses: retrieval stores leak data or accept malicious content.
• LLM09 Misinformation: confident but wrong output is relied on in decisions.
• LLM10 Unbounded Consumption: abuse drives cost, denial of service or model extraction.

Questions to ask before go-live

• Which of these risks were tested, by whom, and against which version of the application?
• What can the application do on a user's behalf, and what requires human approval?
• Does retrieval enforce the same permissions as the source systems?

Source: OWASP GenAI Security Project, Top 10 for LLM Applications 2025.

1. What is the smallest set of tools and scopes the task needs? Remove write, delete and send permissions unless they are essential.
2. Whose identity does each tool call use? Prefer the end user's delegated permissions over a shared service account.
3. What untrusted content will the agent read? Emails, tickets, documents and web pages can all carry indirect prompt injection.
4. Which actions need a human in the loop? Payments, external messages, data exports and configuration changes usually should.
5. Can you reconstruct what the agent did? Log prompts, tool calls, parameters and results, with retention that suits investigations.

For agents connected through the Model Context Protocol (MCP), apply the same questions to each MCP server: who operates it, what it can reach, and how its tool descriptions are reviewed.

References: OWASP LLM06 Excessive Agency; MITRE ATLAS.

India's Digital Personal Data Protection Act, 2023 and the DPDP Rules introduce obligations that commence in phases. A practical sequence:

1. Inventory: map what personal data you collect, why, where it is stored and who processes it for you.
2. Legal basis and notice: confirm consent or legitimate-use grounds and review notices for clarity.
3. Consent and withdrawal: make withdrawal as easy as giving consent, and make sure downstream systems respect it.
4. Processors: update contracts and confirm security safeguards with vendors.
5. Security safeguards and breach response: align controls and notification procedures with the Rules.
6. Rights handling: set up access, correction, erasure and grievance processes with owners and timelines.

Organizations that may be notified as Significant Data Fiduciaries should also plan for additional obligations, such as audits and impact assessments.

This briefing is general information, not legal advice. Confirm current Rules and commencement dates with counsel.

• Access to programs and data: user provisioning and removal, privileged access, periodic access reviews, password and MFA settings.
• Program change: change requests, testing, approval, segregation between developers and production, emergency changes.
• Program development: controls over new systems and major upgrades, including data migration.
• Computer operations: job scheduling and monitoring, backup and restore, incident and problem management.

Where findings usually come from

• Access reviews performed without evidence of what was reviewed or changed.
• Leaver accounts disabled late, or never on secondary systems.
• Changes deployed without retained approval evidence.
• Backups taken but restores never tested.

Fixing the evidence trail often closes more findings than changing the control itself.