For security teams / Control map
kosa8 against the AI security frameworks.
Which of kosa8's controls bear on each item in six frameworks, and where kosa8 does nothing at all.
Self-assessed mapping, not a certificationkosa8 mapped its own controls; no auditor, certification body or framework owner has reviewed this page. kosa8 has no SOC 2 report, no ISO/IEC 42001 certificate and no external penetration test. Whether you meet an obligation depends on your system and the rest of your controls, and is for your assessors to decide.
How to read it
- Addressed a kosa8 control acts on the item directly, with the residual risk in the note
- Partial kosa8 covers part of it; the note says which part is left
- Not covered kosa8 does nothing here
Across the 75 items: 17 addressed, 43 partial, 15 not covered. Most of kosa8's answers are containment: it limits what a manipulated agent can reach and records what it tried, rather than detecting the manipulation.
The controls
- K01A hardware-virtualised microVM per agent, with its own kernel, disk and network
- K02Network rules on the host: deny, allow-list or a simulated internet; refusals recorded
- K03Egress broker: API keys stay on the host, the agent holds a placeholder
- K04Signed organisation policy (Ed25519); a tampered policy refuses everything
- K05Human approval of risky actions by named approvers; signed approvals spent once
- K06Agent identity with an accountable human owner
- K07Signed MCP policy: tools per scope, argument rules, definitions pinned by digest
- K08Audit log written by the host: hash-chained, HMAC-keyed, Ed25519-signed
- K09SIEM forwarding (syslog, Splunk HEC, HTTPS), export as JSONL or CEF, sealed retention
- K10Signed evidence packages, verified offline without kosa8
- K11Hardening baseline check mapped to NIST SP 800-53 families
- K12Checkpoint and rewind, with processes intact
- K13Snapshot encryption at rest, with key rotation; a policy can require it
- K14Model weights pinned by SHA-256; AI bill of materials (CycloneDX 1.6)
- K16Image registry allow-list
- K17Pinned, signed agent kits; unpinned setup refused by default
- K18Per-sandbox CPU and memory sizes, time limits, auto-stop and wiped deletion
- K22Signed and notarised releases, checksums, SBOM per release
- K23Parallel trials, malware detonation on a simulated internet, cyber ranges
Each is a kosa8 CLI command or a policy field in the software today (not the desktop app or the web app); the commands are on every command. On hosted kosa8 Cloud, K04 to K10 are not exposed yet; they run on your own machines, your own servers and your own hosts joined to Cloud.
OWASP Top 10 for LLM Applications 2025
Most of the list is about the model and its data; kosa8 sits around the agent, so its strongest answer is to Excessive Agency.
| ID | Title | kosa8 controls | Status |
|---|---|---|---|
| LLM01:2025 | Prompt Injection | K01, K02, K03, K05, K07Contains what an injected instruction can do. Does not detect or block the injection itself. | Partial |
| LLM02:2025 | Sensitive Information Disclosure | K03, K02, K01Keys never enter the VM and data cannot leave except to allowed hosts. What the model says in its answers is not covered. | Partial |
| LLM03:2025 | Supply Chain | K14, K16, K17, K07, K22Models, images, kits and tool definitions pinned or allow-listed. Training data provenance is not covered. | Partial |
| LLM04:2025 | Data and Model Poisoning | K14Weights pinned by digest, so a swapped model is refused. Poisoned training or fine-tuning data is not covered. | Partial |
| LLM05:2025 | Improper Output Handling | K01, K02, K12Code the model writes runs inside the microVM, behind the network rules, and can be rewound. Output passed to your own downstream systems is not covered. | Partial |
| LLM06:2025 | Excessive Agency | K07, K05, K04, K01, K03Tools per scope, argument rules, approvals for risky calls, and no real credentials in reach. | Addressed |
| LLM07:2025 | System Prompt Leakage | —kosa8 does not protect prompts. Keeping keys out of prompts (K03) limits what a leak exposes. | Not covered |
| LLM08:2025 | Vector and Embedding Weaknesses | —Retrieval stores and embeddings are out of scope. | Not covered |
| LLM09:2025 | Misinformation | —Output accuracy is out of scope. | Not covered |
| LLM10:2025 | Unbounded Consumption | K18Sandbox sizes, time limits and auto-stop; kosa8 Cloud adds per-organisation running limits and a spending cap. Model API spend is not metered. | Partial |
Source: OWASP GenAI Security Project, LLM Top 10. Checked 11 November 2026.
OWASP Top 10 for Agentic Applications (2026)
Published by the OWASP GenAI Security Project's Agentic Security Initiative in December 2025.
| ID | Title | kosa8 controls | Status |
|---|---|---|---|
| ASI01 | Agent Goal Hijack | K01, K02, K03, K05, K07Bounds what a hijacked agent can reach. Does not detect the hijack. | Partial |
| ASI02 | Tool Misuse and Exploitation | K07, K05, K01, K08Argument rules answer allow, deny or ask; held calls wait for a named approver; every decision is logged. | Addressed |
| ASI03 | Identity and Privilege Abuse | K03, K06, K05, K04No real credentials in the VM; agent tokens tie each agent to an owner. Privileges inside the systems a key reaches are set at the provider. | Partial |
| ASI04 | Agentic Supply Chain Vulnerabilities | K07, K17, K14, K16Tool definitions pinned by digest and changed tools withheld; signed kits, pinned models, allowed registries. A server's first definition is trusted unless the policy lists its pins. | Partial |
| ASI05 | Unexpected Code Execution (RCE) | K01, K02, K12Code runs in a microVM of its own with the network decided on the host, and can be rewound. Residual risk: a hypervisor escape. | Addressed |
| ASI06 | Memory & Context Poisoning | K12Rewind restores the sandbox, including memory files, to a checkpoint. Poisoned context is not detected. | Partial |
| ASI07 | Insecure Inter-Agent Communication | K02No protocol-level protection between agents. Network rules can limit which hosts an agent reaches. | Not covered |
| ASI08 | Cascading Failures | K01, K12, K18One machine per agent bounds the blast radius; rewind and time limits stop a run going on. | Partial |
| ASI09 | Human-Agent Trust Exploitation | K05An approval shows what an action would do before it runs. Persuasion of the approver is not covered. | Partial |
| ASI10 | Rogue Agents | K01, K02, K08, K09Contained, recorded and forwarded; can be paused, stopped or removed. Behaviour is not judged. | Partial |
Source: OWASP Top 10 for Agentic Applications for 2026. Checked 11 November 2026.
MITRE ATLAS techniques
The techniques an attacker uses through or against an agent, as named in ATLAS 2026.10. Earlier IDs some lists still cite, such as AML.T0057, have been retired and are not used here.
| ID | Title | kosa8 controls | Status |
|---|---|---|---|
| AML.T0051 | LLM Prompt Injection (.000 Direct, .001 Indirect) | K01, K02, K03, K07The effect is contained; the injection is not detected. | Partial |
| AML.T0054 | LLM Jailbreak | —Not detected. The containment above still applies to what follows. | Not covered |
| AML.T0053 | AI Agent Tool Invocation | K07, K05Tools per scope and argument rules decide each call; risky calls are held. | Addressed |
| AML.T0086 | Exfiltration via AI Agent Tool Invocation | K07, K02Argument rules can deny destinations; hosts are allow-listed. An allowed tool that accepts data is a way out. | Partial |
| AML.T0025 | Exfiltration via Cyber Means | K02, K08Connections outside the allow-list are refused on the host and logged. An allowed host that accepts uploads is a way out; HTTPS bodies are not inspected. | Partial |
| AML.T0055 | Unsecured Credentials | K03Brokered keys never enter the VM; the placeholder is worthless elsewhere. | Addressed |
| AML.T0083 | Credentials from AI Agent Configuration | K03Agent configuration inside the VM holds placeholders, not keys. | Addressed |
| AML.T0098 | AI Agent Tool Credential Harvesting | K03, K07Brokered keys stay outside. Credentials a tool server holds itself are that server's. | Partial |
| AML.T0110 | AI Agent Tool Poisoning (.000 Definition and Instructions) | K07Definitions pinned by digest; a changed definition is withheld until reviewed. The first definition is trusted unless pinned in policy. | Partial |
| AML.T0109 | AI Supply Chain Rug Pull | K07, K14, K17A tool, model or kit that changes after approval no longer matches its pin and is refused. | Addressed |
| AML.T0010 | Supply Chain Compromise (.004 Container Registry, .005 AI Agent Tool) | K16, K07, K14, K22Registry allow-list, tool and model pins. The contents of images you allow are out of scope. | Partial |
| AML.T0081 | Modify AI Agent Configuration | K04, K12Policy is signed and held on the host; configuration inside the VM can be rewound. | Partial |
| AML.T0101 | Data Destruction via AI Agent Tool Invocation | K12, K05, K01Destruction stays inside the VM and rewinds; destructive actions ask every time. | Addressed |
| AML.T0105 | Escape to Host | K01Hardware virtualisation per agent. Residual risk: a hypervisor bug. | Addressed |
| AML.T0112 | Machine Compromise (.000 Local AI Agent) | K01, K03The agent runs in its own VM, not on the workstation, and holds no real keys. | Addressed |
| AML.T0138 | Indicator Removal | K08, K09The log is written outside the VM, hash-chained and signed, and forwarded off the machine. | Addressed |
| AML.T0034 | Cost Harvesting (.002 Agentic Resource Consumption) | K18Sandbox sizes and time limits; Cloud spending cap. Model API spend is not metered. | Partial |
| AML.T0080 | AI Agent Context Poisoning | K12Rewind restores sandbox state; poisoned context is not detected. | Partial |
| AML.T0020 | Training Data Poisoning | —Training is out of scope. | Not covered |
| AML.T0029 | Denial of AI Service | —Availability of model services is out of scope. | Not covered |
Source: MITRE ATLAS, data release 2026.10. Checked 11 November 2026.
NIST AI RMF 1.0
The four functions are Govern, Map, Measure and Manage. Below are the subcategories kosa8's controls produce evidence for, and the part of Map it does not touch.
| ID | Title | kosa8 controls | Status |
|---|---|---|---|
| GOVERN 4.3 | Practices enable AI testing, identification of incidents and information sharing | K23, K08, K10Ranges and parallel trials for testing; logs and evidence for incidents. Sharing is organisational. | Partial |
| GOVERN 6.1 | Policies and procedures address AI risks from third-party entities | K04, K14, K16, K17, K07The signed policy enforces the technical part; the written policy is yours. | Partial |
| MAP 4.2 | Internal risk controls for components, including third-party AI technologies, are identified and documented | K14, K07The AI bill of materials lists model, runtime, MCP servers and policies in force. | Partial |
| MEASURE 2.4 | Functionality and behaviour of the system and its components are monitored in production | K08, K09, K02Actions, refusals and tool decisions are recorded and forwarded. Model quality is not measured. | Partial |
| MEASURE 2.7 | Security and resilience are evaluated and documented | K11, K23, K10Baseline checks and evidence. kosa8 itself has not had an external penetration test. | Partial |
| MEASURE 2.8 | Transparency and accountability risks are examined and documented | K08, K10, K06Who did what, verifiable offline. | Partial |
| MANAGE 2.3 | Procedures to respond to and recover from a previously unknown risk | K12, K02, K18Rewind, close the network, stop on a timer. | Addressed |
| MANAGE 2.4 | Mechanisms to supersede, disengage or deactivate AI systems | K05, K12, K01Pause, stop, remove or rewind a sandbox; deny a held call. | Addressed |
| MANAGE 4.1 | Post-deployment monitoring plans, including appeal and override, incident response, recovery and change management | K09, K12, K04Forwarding, rewind and signed policy changes. The plan is yours. | Partial |
| MANAGE 4.3 | Incidents and errors are communicated; tracking, response and recovery are followed and documented | K08, K09, K10Records and evidence for the incident; communication is organisational. | Partial |
| MAP 1 – 3 | Context, categorisation, capabilities, benefits and costs | —Organisational; kosa8 supplies no impact or context assessment. | Not covered |
Source: NIST AI 100-1; titles shortened. Checked 11 November 2026.
EU AI Act: Articles 12 and 15
Article 12 (Record-keeping) and Article 15 (Accuracy, robustness and cybersecurity) apply to high-risk AI systems. Whether an agent's use is high-risk depends on Article 6 and Annex III. kosa8 supplies evidence; it does not satisfy an article on its own.
| ID | Title | kosa8 controls | Status |
|---|---|---|---|
| Art. 12(1) | Automatic recording of events (logs) over the lifetime of the system | K08Every action is logged automatically by the host service. Model reasoning is not; prompts only when model recording is on. | Addressed |
| Art. 12(2) | Logs to identify risk situations, support post-market monitoring and monitoring under Art. 26(5) | K08, K09, K10, K02, K07Refusals, tool decisions and approvals recorded, forwarded and exportable as signed evidence. | Addressed |
| Art. 12(3) | Minimum logging for remote biometric identification systems | —Not applicable to what kosa8 records. | Not covered |
| Art. 15(1) | An appropriate level of accuracy, robustness and cybersecurity | —Accuracy of the model is out of scope. | Not covered |
| Art. 15(4) | Resilience to errors, faults and inconsistencies; backup and fail-safe plans | K12, K18, K23Checkpoint and rewind; time limits; test before use. | Partial |
| Art. 15(5) | Resilience against unauthorised alteration of use, outputs or performance by exploiting vulnerabilities | K01, K02, K03, K07, K13Contains the effect of manipulated inputs; snapshots can be encrypted at rest. | Partial |
| Art. 15(5) | Measures against data poisoning | —Training data is out of scope. | Not covered |
| Art. 15(5) | Measures against model poisoning | K14Approved weights pinned by SHA-256; a different file is refused. | Partial |
| Art. 15(5) | Measures against adversarial examples or model evasion | —Not detected. | Not covered |
| Art. 15(5) | Measures against confidentiality attacks | K03, K02, K01Keys outside the VM, egress allow-listed, one machine per agent. | Partial |
Source: Regulation (EU) 2024/1689, Official Journal text; summaries, not quotations. Application dates are not stated here. Checked 11 November 2026.
ISO/IEC 42001:2023 Annex A
ISO/IEC 42001 is a management system standard: most of it is the organisation's own process. These are the Annex A controls kosa8's records bear on.
| ID | Title | kosa8 controls | Status |
|---|---|---|---|
| A.4.2 | Resource documentation | K14, K22AI bill of materials per sandbox, session or model; SBOM per release. | Partial |
| A.4.3 | Data resources | —Data documentation is organisational. | Not covered |
| A.4.4 | Tooling resources | K07, K17MCP servers and tools listed and pinned; agent kits pinned and signed. | Partial |
| A.4.5 | System and computing resources | K01, K18, K14Each sandbox's size, image and model are recorded. | Partial |
| A.4.6 | Human resources | —Organisational. | Not covered |
| A.6.2.4 | AI system verification and validation | K23Parallel trials and ranges support your testing; they are not a validation. | Partial |
| A.6.2.5 | AI system deployment | K04, K16, K17, K14Only approved images, kits and models run under policy. | Partial |
| A.6.2.6 | AI system operation and monitoring | K08, K09, K02Recorded on the host and forwarded to your SIEM. | Addressed |
| A.6.2.7 | AI system technical documentation | K10, K11Evidence packages and baseline output. Your system's documentation is yours. | Partial |
| A.6.2.8 | AI system recording of event logs | K08, K09Hash-chained, signed, forwarded, retained by policy. | Addressed |
| A.8.4 | Communication of incidents | K09, K10Records to communicate from; the communication is organisational. | Partial |
| A.10.2 | Allocating responsibilities | K06, K05Agent owners and approvers named in signed records; contracts are organisational. | Partial |
| A.10.3 | Suppliers | K14, K16, K07Controls on model, image and tool suppliers. For kosa8 as a supplier, see the Trust Center. | Partial |
| A.10.4 | Customers | —Organisational. | Not covered |
ISO/IEC 42001 is paywalled. Control numbers and short titles are from secondary sources, not the standard; check them against your copy.
Going further
- EvidenceWhat the frameworks ask about logging and oversight, and what kosa8 records
- StatusTrust Center: controls in place, audit status, subprocessors, documents
- LimitsWhat kosa8 does not protect against
- Overviewkosa8 for security teams
Walk the map with us.
Bring your control framework; we will go through it line by line, gaps included.
Or write to [email protected]. Start free is kosa8 Cloud: $30 credit, card needed.