diff --git a/.github/assets/screenshots/explorer.png b/.github/assets/screenshots/explorer.png new file mode 100644 index 0000000..c5bd753 Binary files /dev/null and b/.github/assets/screenshots/explorer.png differ diff --git a/.github/assets/screenshots/framework-detail.png b/.github/assets/screenshots/framework-detail.png new file mode 100644 index 0000000..6ef67c8 Binary files /dev/null and b/.github/assets/screenshots/framework-detail.png differ diff --git a/.github/assets/screenshots/home.png b/.github/assets/screenshots/home.png new file mode 100644 index 0000000..b14e96f Binary files /dev/null and b/.github/assets/screenshots/home.png differ diff --git a/.github/assets/screenshots/incidents.png b/.github/assets/screenshots/incidents.png new file mode 100644 index 0000000..1d8d0b3 Binary files /dev/null and b/.github/assets/screenshots/incidents.png differ diff --git a/.github/assets/screenshots/score.png b/.github/assets/screenshots/score.png new file mode 100644 index 0000000..8ef0953 Binary files /dev/null and b/.github/assets/screenshots/score.png differ diff --git a/README.md b/README.md index def1976..12b637f 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,28 @@ # GenAI Security Crosswalk + + + +

+ + The Crosswalk web app home page, showing its framework, mapping, entry and registry-control counts + +

+ +

+ Which controls from framework X address GenAI risk Y?
+ Every OWASP GenAI risk, mapped control by control to the frameworks you already have to satisfy. +

+ +

+ Open the web app · + Score your coverage · + Explore entries · + Browse frameworks · + View incidents +

+ [![License: CC BY-SA 4.0](https://img.shields.io/badge/License-CC%20BY--SA%204.0-lightgrey.svg)](https://creativecommons.org/licenses/by-sa/4.0/) [![OWASP Lab](https://img.shields.io/badge/OWASP-GenAI%20Data%20Security-blue)](https://genai.owasp.org) @@ -15,22 +38,26 @@ > **26 frameworks** and > **4 OWASP source lists**. -## [Live Web App](https://genai-security-project.github.io/crosswalk/) | [Score Your Coverage](https://genai-security-project.github.io/crosswalk/#/score) | [Explore Entries](https://genai-security-project.github.io/crosswalk/#/explorer) | [View Incidents](https://genai-security-project.github.io/crosswalk/#/incidents) - Created and led by **[Emmanuel Guilherme Junior](https://github.com/emmanuelgjr)**, who leads the [OWASP GenAI Data Security Initiative](https://genai.owasp.org) . +**Contents:** [TL;DR](#tldr--what-is-this-and-what-do-i-do) · [See it in action](#see-it-in-action) · +[How it fits together](#how-it-fits-together) · [What's inside](#what-this-repository-provides) · +[Source lists](#source-lists) · [Coverage matrix](#framework-coverage-matrix) · +[Mapping files](#all-mapping-files) · [Repository structure](#repository-structure) · +[Start by role](#start-here--by-role) · [Contributing](#contributing) + --- ## TL;DR — What is this and what do I do? **The problem:** You're deploying AI (LLMs, agents, RAG pipelines) and need to know which security controls -apply — across EU AI Act, NIST, ISO, SOC 2, FedRAMP, DORA, and 14 more frameworks. No single document maps -AI risks to all of them. +apply — across EU AI Act, NIST, ISO, SOC 2, FedRAMP, DORA and more: 26 +frameworks in all. No single document maps AI risks to all of them. **This repo solves that.** Every OWASP GenAI vulnerability -(51 total) is mapped to specific controls in -26 industry frameworks. +(51 total) is mapped to specific controls +in 26 industry frameworks. Pick your risk, find your controls. ### 3 ways to use it (pick one) @@ -63,7 +90,76 @@ node scripts/incidents-report.js --format stix # SIEM/SOAR export | **Red teamer** | [LAAF guide](evals/laaf/README.md) → run S1–S6 attack stages, map results to OWASP | | **GRC / auditor** | `compliance-report.js --format oscal` → import into ServiceNow/Archer | | **Developer** | `npm install genai-security-crosswalk` → query risks + controls programmatically | -| **Threat intel analyst** | `incidents-report.js --format stix` → ingest 50 AI incidents into Sentinel/Splunk | +| **Threat intel analyst** | `incidents-report.js --format stix` → ingest 147 AI incidents into Sentinel/Splunk | + +--- + +## See it in action + +The [web app](https://genai-security-project.github.io/crosswalk/) runs entirely in your browser. There's nothing +to install and no login. Click any screenshot to open that page. + + + + + + + + + + +
+ + Explorer: a grid of OWASP entries with severity, source list and their framework, control and incident counts + +
Explorer: search and filter every entry by severity and source list, then open one to see its + controls across all frameworks. + 		+ + Framework view for MITRE ATLAS: the entries it covers and each mapped technique, grouped by entry + +
Frameworks: every control a framework contributes, grouped by the risk it addresses (MITRE ATLAS + shown). +
+ + Score: six frameworks selected, with an overall coverage score card and per-source-list coverage + +
Score: tick the frameworks you implement and get your coverage, gaps and a shareable score card. + 		+ + Incidents: summary counts by severity and type, and cards for individual incidents with linked entries + +
Incidents: real-world and research incidents, filterable by severity, year and MAESTRO layer, each + linked to the risks it exemplifies. +
+ +Screenshots of the web app taken on 2026-10-05. The counts shown in them reflect that date; the live app is +always current. + +--- + +## How it fits together + +There are three main inputs: the Markdown mapping files, the framework registries and the incident records. +The rest is generated from them, so the web app, the npm package and every export stay in step. + +```mermaid +flowchart LR + S([OWASP source lists
LLM, Agentic, DSGAI, Skills]) --> M[Mapping files
one per list and framework] + M --> G[scripts/generate.js] + R[Framework registries
data/frameworks] --> G + I[Incidents
data/incidents.json] --> G + G --> E[Entry data
data/entries] + G --> W[Web app bundles
docs] + E --> N[npm package] + E --> X[Control exports
OSCAL, CSV, JSON, OLIR] + R --> X + I --> T[Incident export
STIX 2.1] +``` --- @@ -93,10 +189,10 @@ All free. All open-source. Built for practitioners. | List | Entries | Version | Frameworks mapped | |---|---|---|---| -| [OWASP LLM Top 10](https://genai.owasp.org/llm-top-10/) | LLM01–LLM10 | 2026 | 23 | -| [OWASP Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) | ASI01–ASI10 | 2026 | 23 | -| [OWASP GenAI Data Security Risks](https://genai.owasp.org/resource/owasp-genai-data-security-risks-mitigations-2026/) | DSGAI01–DSGAI21 | 2026 | 21 | -| [OWASP Agentic Skills Top 10](https://owasp.org/www-project-agentic-skills-top-10/) | AST01–AST10 | 2026 | — *(registered; mappings pending)* | +| [OWASP LLM Top 10](https://genai.owasp.org/llm-top-10/) | LLM01–LLM10 | 2026 | 26 | +| [OWASP Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) | ASI01–ASI10 | 2026 | 26 | +| [OWASP GenAI Data Security Risks](https://genai.owasp.org/resource/owasp-genai-data-security-risks-mitigations-2026/) | DSGAI01–DSGAI21 | 2026 | 24 | +| [OWASP Agentic Skills Top 10](https://owasp.org/www-project-agentic-skills-top-10/) | AST01–AST10 | 2026 | 1 *(MAESTRO, DRAFT rows only)* | --- @@ -231,6 +327,9 @@ All free. All open-source. Built for practitioners. ## Repository structure +
+Show the full directory tree + ```text crosswalk/ │ @@ -333,7 +432,7 @@ crosswalk/ │ ├── data/ │ ├── schema.json ← JSON Schema (Draft 7) for entry files -│ ├── incidents.json ← 50 incidents with MAESTRO layer attribution +│ ├── incidents.json ← 147 incidents with MAESTRO layer attribution │ ├── incidents-schema.json ← JSON Schema for incidents │ ├── tools-supplement.json ← Supplemental tools merged at generation time │ ├── entries/ ← 51 machine-readable entry JSON files @@ -371,6 +470,8 @@ crosswalk/ └── pt/ ← Portuguese (accepting PRs) ``` +
+ --- ## Compliance gap reports @@ -416,7 +517,8 @@ See `evals/laaf/README.md` for the full LPCI attack vector → OWASP → MAESTRO ## Incident tracker -50 real-world and research-demonstrated incidents, each mapped to OWASP entries and MAESTRO architectural layers: +The tracker holds 147 real-world and research-demonstrated incidents, each +mapped to OWASP entries and MAESTRO architectural layers: ```bash node scripts/incidents-report.js # all incidents → reports/incidents.md @@ -441,7 +543,7 @@ No install required. Works on desktop and mobile. | [**Score**](https://genai-security-project.github.io/crosswalk/#/score) | Select your frameworks, see coverage gaps. Upload Garak/PyRIT/LAAF results to validate. Share your score card on LinkedIn. | | [**Explorer**](https://genai-security-project.github.io/crosswalk/#/explorer) | Search and filter all 51 entries. Click any entry to see controls across all 26 frameworks. | | [**Frameworks**](https://genai-security-project.github.io/crosswalk/#/frameworks) | Interactive 51×26 coverage matrix. Click any cell to see the specific controls mapped. | -| [**Incidents**](https://genai-security-project.github.io/crosswalk/#/incidents) | Browse 50 AI security incidents. Filter by severity, year, MAESTRO layer. Full attribution details. | +| [**Incidents**](https://genai-security-project.github.io/crosswalk/#/incidents) | Browse 147 AI security incidents. Filter by severity, year, MAESTRO layer. Full attribution details. | **Evidence-based scoring** — three validation tiers: @@ -558,6 +660,9 @@ manipulation scenario) ## Quick navigation +
+Show quick links by scenario (EU AI Act, NIS2, OT/ICS, agents, ISO, FedRAMP, DORA and more) + **EU AI Act compliance by August 2026** → [LLM_EUAIAct.md](llm-top10/LLM_EUAIAct.md) · [Agentic_EUAIAct.md](agentic-top10/Agentic_EUAIAct.md) · [DSGAI_EUAIAct.md](dsgai-2026/DSGAI_EUAIAct.md) @@ -622,6 +727,8 @@ includes EU AI Act compliance evidence table **All risks across all three source lists** → [CROSSREF.md](CROSSREF.md) — master cross-reference +
+ --- ## Standout coverage