Individual attacks and controls are easier to manage when they sit inside a structure. Risk management frameworks give teams a shared vocabulary and a repeatable process for deciding what could go wrong, how likely and how serious it is, and what to do about it.
Three frameworks come up again and again. The NIST AI Risk Management Framework organizes the work into four functions: Govern, Map, Measure, and Manage. MITRE ATLAS catalogs the tactics and techniques attackers use against AI systems, in the style of ATT&CK. The OWASP Top 10 for LLM Applications lists the most common vulnerabilities developers need to design against. They answer different questions, and they work best together.
Watch the lessons in order, then continue on to AI Regulation & Compliance, where these frameworks meet the laws and standards that organizations are required to follow.
A plain-language introduction to the NIST AI RMF and how organizations use it to govern and secure their AI systems.
A closer look at how to govern, map, measure, and manage AI risk with the framework in day-to-day work.
An explanation of MITRE ATLAS, the knowledge base that categorizes attacks against AI systems, and how security teams can use it.
An introduction to the OWASP Top 10 for LLM Applications 2025 and the most critical risks it lists for LLM-based systems.