Understanding OWASP’s
On September 10, 2025, the Open Web Application Security Project (“OWASP”) released Threat Defense COMPASS 1.0, a new framework designed to help organizations assess, enhance, as well as improve on their security posture and defenses in Gen AI environments. Generative AI refers to a type of artificial intelligence that learns patterns from existing data and uses that knowledge to generate new content, rather than copying the original data.
Building on this framework, COMPASS combines “AI threats, vulnerabilities, defenses, and mitigations into a unified AI Threat Resilience Strategy Dashboard,” allowing teams to continuously assess their AI environments, adapt to evolving threats, and focus on high impact efforts.
Key Features of Threat Defense COMPASS 1.0
Designed for Iterative Use
- Curated for ongoing, continuous use, allowing organizations to adapt, regularly update, and mature their defense over time.
Serves as Both a Methodology and a Practical Spreadsheet Tool
- COMPASS comes with a hands-on spreadsheet tool that guides teams through rapid threat prioritization and strategic decision making of real-world scenarios.
Covers Both External Adversaries and Internal Deployments
- COMPASS evaluates everything from external adversaries or threats that use AI tools to internal deployments of Microsoft Copilot, Google Gemini, and proposed GenAI or Agentic projects.
Actionable and Customizable for Teams
- A runbook, training video, and in-depth documentation guide are included and available for operational use, making it easier for applying the framework. OWASP also provides and outlines a 5-point scoring system that can be customized to fit your organization’s needs.
Example: The 5-point Scoring System
COMPASS includes a threat scoring system based on Impact and Likelihood scale(s) of threat estimation.
Impact: How disruptive would this threat be if realized? (1: Low, 5: Critical).
Likelihood: How likely is this threat to occur? (1: Unlikely, 5: Highly Likely). If unsure, err on the side of caution by assigning a higher score until further evidence is gathered.
With this offer of a 5-point score system, organizations can remain proactive and avoid underestimating emerging threats.
Why This Matters & How It Affects You?
Staying Ahead: With rapidly evolving threats, frameworks like COMPASS can help provide more structure in how your organization makes decisions and evaluates risk, while also adding in an extra layer of security and awareness.
Prioritize What Matters: Depending on your organization’s complexity, size, and exposure to AI and threats, COMPASS helps to prioritize and identify where vulnerabilities exist, and which are the most critical ones are to focus on.
Designed for Real-World Scenarios and Security Teams: Having a runbook and documented resources for built-in training and guidance shows that COMPASS is intended for operational use, not just for overall knowledge. It’s practical and scalable for security teams to utilize, integrate, and align for effective visibility of day-to-day operations.
OWASP’s Key Success Factors for Using COMPASS
To get the most out of the Threat Defense COMPASS framework, OWASP outlines four best practices to keep in mind:
- Customization is Encouraged: Modify any aspect of COMPASS to suit your organization’s needs. The included 5-point scoring method can be adapted to any scale that works for your team.
What this means: This suggests that COMPASS is flexible and adaptable to fit into your organization’s processes and standards. - Holistic Evaluation: Artificial Intelligence must be assessed as part of your organization’s entire technology stack and threat landscape, not in isolation.
What this means: Evaluate your entire threat landscape to get a broader, overall picture of exposure and where your organization stands operationally. - Total Impact Assessment: AI Governance, Safety, and Privacy considerations should be evaluated based on their complete impact cost to the organization.
What this means: Account for and evaluate the full potential cost as well as impact of AI risks on your organization. This may include regulatory compliance, reputational damage, and/or disruptions to daily operations. - One of many OWASP Resources: There are many other OWASP resources that support building a threat resilient strategy such as OWASP CycloneDX, OWASP API Top 10, OWASP ASVS, and OWASP Cheat Sheets.
What this means: Leverage other OWASP tools to ensure COMPASS can seamlessly be integrated with other OWASP security tools. This builds a stronger layered foundation of defense.
Ultimately, OWASP’s Threat Defense COMPASS 1.0 is a structured, risk-informed framework that helps organizations strengthen their AI security practices, build long-term resilient defenses, and improve their overall security posture. If you’re looking to assess risk, evaluate your current defenses, or need guidance on applying the COMPASS framework, our team is here to help!
Contact our experts today to get started.
Contact Us
References
Definition of Generative AI – Gartner Information Technology Glossary
OWASP GenAI Security Project Threat Defense COMPASS 1.0 – OWASP Gen AI Security Project
