⚡ Quick Summary
Published by the OWASP Gen AI Security Project under its AI Threat Intelligence & Response Initiative, this guide (Version 1.0, July 28, 2025) offers security practitioners guidelines and best practices for responding to security incidents involving generative AI applications. It states that it was produced by a panel of experts convened by the project's CTI Initiative, is written for security practitioners without assuming deep GenAI knowledge, and is intended as a complement to existing incident response processes rather than a complete account of all relevant activities.
The guide opens by defining AI incidents, noting that no widely accepted definition exists and adopting the OECD framing of an event where the development, use or malfunction of AI systems leads to specific harms. Five vignettes illustrate the problem: the Air Canada chatbot, Microsoft's Tay, the EchoLeak zero-click Copilot vulnerability (CVE-2025-32711, CVSS 9.3), a MathGPT code-execution exploit and a ChatGPT Operator data leak. The remainder follows the NIST incident response lifecycle: preparation, detection, reporting and severity scoring, the response plan and AI incident response team, then event-specific guidance for attacks on AI systems, supply chains and third-party model providers, with appendices on response roles and physical AI.
🧩 What’s Covered
- Defining AI incidents: argues that no authoritative definition exists; presents five vignettes, compares definitions from NIST, the OECD, the EU AI Act, the AI Incident Database, Cimphony.ai and Zendata, then sets out diagnostic criteria by AI stack layer (model, implementation, system, runtime) with a quick reference mapping OWASP LLM Top 10 risks to MITRE ATLAS techniques.
- Preparation: risk identification across assets, users, operations, reputation and autonomy; a risk management framework aligned to the NIST AI RMF; adding AI/GenAI risk to the enterprise risk register with an example entry (AI-001, prompt injection leaking sensitive data); classifying AI assets by functionality, criticality, data sensitivity and deployment strategy; asset inventories, model cards and dataset records; access mapping, security posture assessment, non-human identities, network diagrams and stakeholder RACI charts.
- Detecting an AI incident: core detection techniques including prompt injection monitoring, prompt velocity analysis, out-of-distribution detection, model drift and content-policy monitoring; integrating telemetry into SIEM/SOAR with example rules; dashboard and alerting design; a four-level detection maturity model.
- Reporting AI incidents: secure communication protocols, notification procedures, public relations and crisis communication, an internal reporting template, a severity matrix using dimensions scored 1 to 4, and prioritisation of risks by severity.
- Response plan: defining the blast radius across models, datasets, applications, decisions and reputation; severity-based SLAs (Critical: containment under 15 minutes, eradication under 4 hours, RTO under 8 hours); the AI incident response team by organisation size; AI security training for responders and employees.
- Event-specific guidance: prompt injection, evasion, model poisoning, data exfiltration, RAG poisoning and agent exploitation; supply chain attacks with poisoning and backdoor detection tools; and third-party model provider risks, each with detection, containment, eradication, recovery and post-incident steps.
- Appendices: tiered AI incident response roles, additional roles for physical AI incidents, and lists of 20 potential issues and 10 consequences for physical or embodied AI.
💡 Why it matters?
Security teams are being asked to monitor and secure generative AI applications whose probabilistic outputs and agentic behaviour break the assumptions behind conventional incident response. The guide gives them concrete scaffolding: how to tell an AI incident from a cyber incident, what evidence to collect, which severity score to assign, and which containment or eradication steps fit prompt injection, poisoning or third-party model compromise. Its mapping of detection rules to OWASP LLM Top 10 risks and MITRE ATLAS techniques lets analysts connect alerts to known threats, and its preparation material helps organisations fold AI risks into existing registers, RACI charts and SLAs rather than building a parallel process.
❓ What’s Missing
The guide deliberately stops short of being a complete incident response manual and expects readers to pair it with their existing processes. Several areas stay at a high level: the five severity dimensions the text refers to are not reproduced in full, and the SLA example covers only one severity tier. The legal and regulatory discussion names the EU AI Act, GDPR and CCPA and mentions breach-notification duties without giving jurisdiction-specific timelines or decision trees. Coverage of physical and embodied AI is explicitly an early overview, with work in progress to make it a separate initiative. Quantitative benchmarks, complete sample runbooks and worked forensic examples are also absent.
👥 Best For
AI incident responders, SOC analysts and security engineers who are first called when a GenAI application misbehaves or is attacked; CISOs and security architects scoping an AI incident response capability and its staffing; and risk, governance and compliance teams adding GenAI scenarios to enterprise risk registers, severity matrices and response SLAs.
📄 Source Details
GenAI Incident Response Guide, Version 1.0, published by the OWASP Gen AI Security Project (AI Threat Intelligence & Response Initiative), dated July 28, 2025. The 82-page PDF is in English and is internally page-numbered from 1 after the cover. Contributors are listed in the Acknowledgements, beginning with Bryan Nakayama, Rachel James and Keyur Rajyaguru. No URL for the document itself is printed on its pages; only the project site genai.owasp.org is given. The input was a partial text extraction covering 80 of 82 pages, from the cover through the Acknowledgements; the closing sponsor and supporter listings were not available.
