Cookie Preferences

    We use cookies for analytics and to identify companies visiting our site (not individuals). Essential cookies are always active. Learn more

    Security Resources

    VULNERABILITY DATABASES

    Essential resources for tracking security vulnerabilities across AI systems, web applications, APIs, and software supply chains.

    AI/ML Security

    OWASP Top 10 for LLMs

    Visit Database

    The definitive list of the most critical security risks for Large Language Model applications, maintained by OWASP.

    Key Features:

    • •Covers prompt injection, data poisoning, and model theft
    • •Updated annually with emerging threats
    • •Industry-standard for LLM security assessments
    • •Includes remediation guidance

    When to Use:

    The foundation for any LLM security assessment. Required knowledge for vendors building or buyers evaluating AI products.

    Explore OWASP

    MITRE ATLAS

    Visit Database

    Adversarial Threat Landscape for AI Systems. A knowledge base of adversary tactics and techniques based on real-world attack observations.

    Key Features:

    • •Maps AI attack techniques to the ATT&CK framework
    • •Documents real-world AI attack case studies
    • •Provides defensive recommendations
    • •Covers the full AI/ML lifecycle

    When to Use:

    Understand how attackers target AI systems in practice. Critical for threat modeling AI deployments.

    Explore MITRE

    MIT AI Risk Repository

    Visit Database

    A comprehensive database of 1,600+ AI risks extracted from 74 frameworks. Includes causal and domain taxonomies for classifying AI risks.

    Key Features:

    • •1,600+ risks with source citations and evidence
    • •Causal taxonomy (entity, intentionality, timing)
    • •7 risk domains including safety, privacy, misuse
    • •Updated regularly with new frameworks

    When to Use:

    Comprehensive risk identification for AI governance. Useful for policy development and risk assessments.

    Explore MIT

    NIST AI RMF

    Visit Database

    The NIST AI Risk Management Framework provides guidance for managing AI risks. Updated in 2025 for generative AI.

    Key Features:

    • •Voluntary framework for AI risk management
    • •Generative AI profile (NIST-AI-600-1)
    • •Aligns with cybersecurity frameworks
    • •Covers bias, explainability, and model vulnerabilities

    When to Use:

    Framework for AI governance and risk management. Required reference for enterprise AI deployments.

    Explore NIST

    AI Incident Database

    Visit Database

    A comprehensive database cataloging real-world AI failures, harms, and near-misses. Maintained by the Responsible AI Collaborative with over 3,000 incident reports.

    Key Features:

    • •Documents real-world AI harms and failures
    • •Searchable taxonomy of AI incident types
    • •Public GraphQL API for data access
    • •Community-contributed and peer-reviewed reports

    When to Use:

    Learn from past AI failures to prevent future incidents. Essential for AI risk assessments and due diligence.

    Explore AI

    General Security

    NIST NVD (National Vulnerability Database)

    Visit Database

    The U.S. government repository of standards-based vulnerability data using CVE identifiers. The authoritative source for software vulnerabilities.

    Key Features:

    • •Contains 200,000+ CVE entries
    • •CVSS scoring for severity assessment
    • •Integration with security tools and scanners
    • •Includes vendor advisories and patches

    When to Use:

    Check for known vulnerabilities in software dependencies, frameworks, and infrastructure components.

    Explore NIST

    ENISA EUVD (European Vulnerability Database)

    Visit Database

    The EU's vulnerability database mandated by NIS2 Directive. Provides a European alternative to US-centric vulnerability sources with its own EUVD identifiers.

    Key Features:

    • •EU-coordinated vulnerability disclosures
    • •Aggregates data from European CSIRTs
    • •Dashboards for critical and exploited vulns
    • •Parallel system to CVE with EUVD identifiers

    When to Use:

    Essential for EU-based organizations and NIS2 compliance. Provides European perspective on vulnerabilities.

    Explore ENISA

    Web Security

    OWASP Top 10 for Web Applications

    Visit Database

    The standard awareness document for web application security. Represents broad consensus on the most critical security risks to web applications.

    Key Features:

    • •Updated every 3-4 years based on data analysis
    • •Covers injection, broken access control, cryptographic failures
    • •Industry-standard for web security assessments
    • •Extensive documentation and remediation guides

    When to Use:

    Foundational checklist for any web application security assessment. Required for compliance frameworks.

    Explore OWASP

    API Security

    OWASP Top 10 for APIs

    Visit Database

    Security risks specific to APIs, addressing the unique challenges of API-first architectures and microservices.

    Key Features:

    • •Covers BOLA, broken authentication, excessive data exposure
    • •API-specific attack patterns
    • •REST, GraphQL, and gRPC considerations
    • •Updated for modern API architectures

    When to Use:

    Essential for assessing API security in SaaS products, mobile backends, and microservices architectures.

    Explore OWASP

    Software Security

    CWE (Common Weakness Enumeration)

    Visit Database

    A community-developed list of software and hardware weakness types. Serves as a common language for describing security weaknesses.

    Key Features:

    • •900+ weakness types catalogued
    • •Hierarchical organization of weaknesses
    • •Maps to CVEs and other databases
    • •Used by static analysis tools

    When to Use:

    Understand the root causes of vulnerabilities. Useful for secure code review and developer training.

    Explore CWE

    Threat Intelligence

    MITRE ATT&CK

    Visit Database

    A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

    Key Features:

    • •Covers enterprise, mobile, and ICS environments
    • •Documents adversary groups and their techniques
    • •Provides detection and mitigation guidance
    • •Industry standard for threat modeling

    When to Use:

    Map security controls to known attack techniques. Essential for building detection and response capabilities.

    Explore MITRE

    Supply Chain Security

    GitHub Advisory Database

    Visit Database

    A database of CVEs and GitHub-originated security advisories affecting open source software.

    Key Features:

    • •Covers npm, pip, RubyGems, and more
    • •Integrates with Dependabot alerts
    • •Community-contributed advisories
    • •Machine-readable format (OSV)

    When to Use:

    Monitor open source dependencies for known vulnerabilities. Critical for software supply chain security.

    Explore GitHub

    NEED HELP ASSESSING VULNERABILITIES?

    Our security experts can help you understand how these databases apply to your AI systems and vendor assessments.