owasp

Interviewers ask for the list to see whether you are current. They ask how you would use it to see whether you understand it is an awareness document, not a standard.

A standard is a checklist only if you use it badly. The answer interviewers want maps the app's data and threats onto MASVS areas, then picks which MASTG tests are worth the time.

A knowledge check with two traps: two editions are in circulation with different numbers, and reciting names earns little. Grouping the ten into entries and impacts, and applying them to a system, earns the rest.

The LLM list has one item for agency. The agentic list spends ten on it. The answer that scores explains why, and which new risks only exist once agents act, remember and talk to each other.

Three frameworks, three different questions: what can go wrong in what we build, how attackers actually operate, and how the organisation manages the risk. Using one for another's job is the common mistake.

Frameworks for AI risk are plentiful; baselines that say what security controls an AI system needs are newer. The scored answer knows what each one is, how binding it is, and how to turn it into a control set.