Mapping AI agent risks to MITRE ATLAS and the NIST AI RMF

Reviewers in regulated companies describe agent risk in three vocabularies. The OWASP Top 10 for Agentic Applications names the risk. MITRE ATLAS names the attacker's technique and the mitigation. The NIST AI Risk Management Framework names the governance outcome. A finding that uses all three is easier to review, because each reviewer can place it in the system they already use.

This post gives a crosswalk between the three and shows how to write a finding with it.

Key takeaways

• OWASP names the risk, ATLAS names the technique and mitigation, and the NIST AI RMF names the outcome. Use all three in each finding.
• ATLAS now covers agents in depth. Release v2026.09 has techniques such as AI Agent Context Poisoning and mitigations such as Human In-the-Loop for AI Agent Actions.
• The NIST AI RMF is still version 1.0. NIST says a revision is under way. There is no "AI RMF 2.0".
• Attach evidence to every mapping: the reproduction, the fix and the retest.
• Mappings are judgment calls. Record the framework versions you used, and review the mapping when they change.

The three frameworks in brief

• OWASP Top 10 for Agentic Applications for 2026: ten agent risks, ASI01 to ASI10, from the OWASP GenAI Security Project. OWASP names editions by the year they govern.
• MITRE ATLAS: a knowledge base of adversary tactics and techniques against AI systems, modeled on MITRE ATT&CK. Release v2026.09 (September 15, 2026) has 16 tactics, 120 techniques, 88 sub-techniques, 40 mitigations and 73 case studies. Every technique carries platform tags, and 139 are tagged Agentic AI.
• NIST AI RMF 1.0 (NIST AI 100-1): four functions, Govern, Map, Measure and Manage, with numbered outcomes in each. The Generative AI Profile (NIST AI 600-1) adds risks specific to generative AI.

The crosswalk

This mapping is our analysis, not an official crosswalk. Technique and mitigation IDs come from ATLAS v2026.09. NIST outcomes come from AI RMF 1.0.

What the NIST outcomes in the table ask for, in short:

• MAP 3.5: processes for human oversight are defined, assessed and documented.
• MAP 4.1: the technology and legal risks of each component, including third-party data and software, are mapped.
• MEASURE 2.4: the behavior of the AI system and its components is monitored in production.
• MEASURE 2.7: the security and resilience of the AI system are evaluated and documented.
• MANAGE 1.3: responses to high-priority risks are developed, planned and documented.
• MANAGE 2.4: there are mechanisms, with assigned owners, to supersede, disengage or deactivate an AI system that behaves outside its intended use.
• MANAGE 3.1 and GOVERN 6.1: third-party risks are covered by policy, monitored and controlled.
• MANAGE 4.1: post-deployment monitoring plans cover incident response, recovery and change management.

Two outcomes apply to every row: GOVERN 1.6, an inventory of AI systems, and GOVERN 4.3, practices that enable AI testing, incident identification and information sharing. ATLAS also lists AI red teaming as a mitigation in its own right (AML.M0035).

How to write a finding reviewers accept

Here is an illustrative finding for a loan review agent:

Indirect prompt injection in uploaded documents can make the agent approve an application.

• OWASP: ASI01 Agent goal hijack.
• ATLAS: AML.T0051.001 LLM Prompt Injection: Indirect. Mitigations AML.M0030 and AML.M0033.
• NIST AI RMF: MEASURE 2.7 (security evaluated and documented) and MANAGE 1.3 (response to a high-priority risk).
• Evidence: the poisoned document and each step the agent took, shown on an isolated copy. The fix, for example blocking the approval tool when the request comes from untrusted document content, or holding approvals for a person. A retest that shows the attack now fails. A replay of approved tasks that shows the agent still does its job.

The same evidence also supports ISO/IEC 42001 and AIUC-1 reviews. Our post on AIUC-1 and ISO 42001 for AI agents maps it to both, and our guide to AI penetration testing for agents covers how to produce it.

Keep the mapping current

ATLAS changes often: MITRE published five releases between May and September 2026. OWASP issues a new agentic edition each year, and NIST is revising the AI RMF. Record the version of each framework in every report, and review the crosswalk when any of them changes.

Questions

What is MITRE ATLAS?

MITRE ATLAS (Adversarial Threat Landscape for AI Systems) is a public knowledge base of adversary tactics, techniques, mitigations and case studies for AI systems, modeled on MITRE ATT&CK. Release v2026.09 lists 120 techniques, 88 sub-techniques and 40 mitigations, and tags 139 techniques with the Agentic AI platform.

What are the four functions of the NIST AI RMF?

Govern sets policies, roles and culture for AI risk. Map establishes the context and identifies risks. Measure analyzes, assesses and tracks those risks. Manage prioritizes and acts on them, including monitoring after deployment.

Is there a NIST AI RMF 2.0?

No. The current version is AI RMF 1.0 (NIST AI 100-1, January 2023), with the Generative AI Profile (NIST AI 600-1, July 2024). NIST says AI RMF 1.0 is being revised as part of the White House AI Action Plan.

How do the OWASP agentic Top 10 and MITRE ATLAS differ?

OWASP lists the most important risks for a type of application. ATLAS catalogs how attackers carry out attacks on AI systems, with techniques, mitigations and case studies. Use OWASP to frame the risk and ATLAS to describe the attack and the defense.

Is there an official crosswalk between these frameworks?

Not for this exact combination. OWASP publishes crosswalks for some standards, such as AIUC-1, and NIST's AI Resource Center hosts crosswalks between the AI RMF and other frameworks. The mapping in this post is our own analysis.