Security
LLM security: the main risks and the controls to start with
Kriv AI helps teams put limits around applications built on large language models. This page names the main risks and where to start.
LLM security is the practice of protecting applications built on large language models from misuse, leaking data and causing harm. The risks differ from ordinary software because, as OWASP describes it, inputs that change a model's behaviour can come from the user or from external content the model processes, such as websites or files, and a person does not need to be able to read them. OWASP's GenAI Security Project publishes a Top 10 list of risks for these applications, led by prompt injection and sensitive information disclosure. Good first controls are simple: limit what the model can access and do, treat its output as untrusted, keep logs, and test with hostile inputs before release.
plain answer
What is LLM security?
A large language model reads text and produces text. An application built on one often also reads documents, calls tools and acts on the result. Security here means deciding what that application can see and do, and checking what it produces before anyone relies on it.
One difference from ordinary software is that instructions and data arrive in the same form: a model reads an email it is asked to summarise as text, just as it reads the request. OWASP says it is "unclear if there are fool-proof methods of prevention" for prompt injection. In our view, most of the controls below follow from that.
framework
The OWASP Top 10 risks for LLM applications
OWASP's "2025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps" lists these ten, read on 2026-11-10. The plain-word notes are ours.
1. Prompt Injection
Input, direct or hidden in content, changes what the model does.
2. Sensitive Information Disclosure
The application reveals data it should not.
3. Supply Chain
Models, data or components you depend on are themselves a weak point.
4. Data and Model Poisoning
Training, fine-tuning or embedding data is tampered with.
5. Improper Output Handling
Model output is passed on without enough checking.
6. Excessive Agency
The system is given more ability to act than the job needs.
7. System Prompt Leakage
Hidden instructions are exposed to users.
8. Vector and Embedding Weaknesses
Search over stored documents returns or exposes the wrong material.
9. Misinformation
The model produces false or misleading output that people rely on.
10. Unbounded Consumption
Uncontrolled use of the model runs up cost or degrades service.
how to
Controls to start with
These starting points are our own, not OWASP's mitigation list. They map to the risks above and are not a complete programme.
| Risk area | A usual first control | Who decides |
|---|---|---|
| Prompt injection | Treat all retrieved content as untrusted and keep the model's permissions narrow. | Security and the application owner |
| Data disclosure | Limit which data the model can read, per user, and test for leaks. | Data owners and security |
| Output handling | Validate output before it reaches another system or a customer. | The application team |
| Excessive agency | Start read-only and require a person to approve actions that change records. | The business owner |
| Supply chain | Keep a list of the models and components in use, and review changes. | IT and procurement |
| Unbounded consumption | Set usage limits and alerts. | IT and finance |
differentiation
Pages on prompt injection, MCP security, agents and testing
Two risks deserve their own pages: see prompt injection and MCP security. For agents that take actions, our AI agent security risk page covers the enterprise side, and our LLM evaluation framework page covers testing.
kriv role
Where Kriv helps
Kriv AI reviews an LLM application with your team against the OWASP list and agrees the first fixes. See our AI security consulting page. Work is scoped and priced after a short discovery call.
We do not replace your security team's own testing, and we make no promise that an application is free of these risks.
limits
What this page does not cover
This page is a general overview, informed by the OWASP list. It is not a security assessment of your system and not a legal or regulatory opinion. We cite no incident or loss statistics, because we did not find a source we could read and quote on 10 November 2026.
Straight answers
Frequently asked questions about LLM security: the main risks and the controls to start with
What is LLM security?
It is protecting applications built on large language models from misuse, data leaks and harmful output, by limiting what they can access and do and checking what they produce.
What are the main LLM risks?
OWASP's 2025 Top 10 for LLM applications lists prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption.
What is prompt injection?
It is when input, typed by a user or hidden in content the model reads, changes what the model does. See our prompt injection page for more.
How do I secure an LLM application?
Start by limiting its data access and permissions, treating its output as untrusted, logging what it does, and testing it with hostile inputs before release.
Is LLM security different from normal application security?
It adds new risks. OWASP describes prompt injection as inputs that change a model's behaviour in unintended ways, including through external content the model processes. In our view, normal controls such as access management still apply.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call