Industry standards and frameworks
The standards that shape how organisations govern AI, manage risk, and prove their controls work. Each entry maps the framework's own language back to the ATLAS risk and control model.
Seven frameworks covering vulnerability standards, threat intelligence, risk management, regulation, and industry practice. Select by category or compare across domains.
Vulnerability standard
The definitive industry standard identifying the ten most critical security risks for applications powered by large language models, updated for 2026 with refined rankings, new threat categories, and mappings to MITRE ATLAS, CWE, and NIST AI RMF.
Threat framework
A globally recognised knowledge base of adversary tactics, techniques, and case studies for AI systems, modelled after the MITRE ATT&CK framework and maintained by the MITRE Corporation.
Vulnerability standard
A dedicated top-10 list addressing the unique security challenges of agentic AI systems — where LLMs plan, execute multi-step tasks, invoke tools, and operate with delegated authority over enterprise systems.
Regulation
The European Union's comprehensive regulatory framework for artificial intelligence, establishing a risk-based classification system with escalating obligations for providers and deployers of AI systems.
Management standard
The first international standard specifying requirements for establishing, implementing, maintaining, and continually improving an AI management system within an organisation.
Industry framework
A conceptual framework from Google for securing AI systems across their lifecycle, built on six core elements that extend familiar security principles into the AI domain.
Risk management
The U.S. National Institute of Standards and Technology framework for managing risks in the design, development, use, and evaluation of AI products and services.
Start with the risk you care about in the Risk Catalogue, find the control that mitigates it in the Controls Catalogue, then return here to see which framework demands evidence for that control.
Risk → Control → Framework → Evidence. That is the operational reading ATLAS was built for.
