Skip to content

OWASP AISVS Library

Use the configured OWASP AISVS 1.0 library to map AI application security findings, evidence, remediation, and retests to canonical requirements.

The OWASP AI Security Verification Standard provides requirements for reviewing security controls in AI-enabled systems. The voiqq system library uses canonical AISVS 1.0 records to give findings a stable requirement identity beyond a tool name or probe result.

Standards and scope

AISVS mapping should reflect the control actually tested and the boundary where the failure occurs. Model output, application logic, retrieval, tools, identity, data, infrastructure, and third-party providers can produce different issues even when the visible symptom appears similar.

  • Project requirements capture the AI system type and assessment context.
  • Canonical mappings help distinguish model behavior from application and integration controls.
  • Garak probe metadata can support evidence but remains subject to professional validation.
  • Likelihood, impact, severity, and remediation should consider the deployed system and available safeguards.
  • Retest and validation preserve whether a control was corrected in the assessed configuration.

Who this is for

  • AI security learners and educators building standards-based assessment skills.
  • Red teams, security researchers, and professional AI application assessors.
  • Engineering and governance teams translating risks into testable controls.
  • Organizations and public bodies seeking a repeatable AI security review structure.

What voiqq provides

  • Canonical AISVS identifiers, requirement descriptions, and references.
  • Project metrics for model, application, API, agent, or RAG assessment context.
  • Structured evidence and remediation fields for manual and normalized candidates.
  • Assignments, comments, status, validation, and review history.
  • AISVS-aligned assessment snapshots from approved project findings.

A practical workflow

  1. Define the authorized system, model, provider, data, tools, interfaces, and threat context.
  2. Select applicable requirements and a safe, reproducible test method.
  3. Map findings to the most precise requirement supported by the observed control failure.
  4. Review impact and remediation across the responsible technical boundary.
  5. Retest and approve the final assessment snapshot.

Put the framework into practice

The AISVS library provides a shared requirements vocabulary for researchers, engineers, governance teams, and clients while voiqq preserves the operational record around the assessment.

Start free

Read the OWASP AISVS project page

voiqq uses the stable OWASP AISVS 1.0 catalogue: 191 requirements in 12 chapters with verification levels 1, 2, and 3. AISVS requirements are assessment requirements, not prewritten findings; several findings can be connected to one requirement when the evidence warrants it.