Turning the OWASP Agentic Top 10 Into Expected Loss

The OWASP list for agentic applications, published in December 2025, gives security teams a shared vocabulary for what goes wrong when software acts rather than answers. Ten categories covering planning, tools, identity, supply chain, code execution, memory, inter-agent communication, cascading failures, human trust and rogue behavior.

‍

Translating that into a financial figure is where programs stall, and the usual attempt makes a specific error. Registering each of the ten as a scenario with its own expected loss produces a total that overstates exposure substantially, because the ten do not sit at the same level of the causal chain.

‍

The Categories Describe Three Different Things

‍

Sorting them by role in an incident rather than by number makes the translation obvious.

‍

Some Are Entry Points

‍

Goal hijack, memory and context poisoning, agentic supply chain compromise and human trust exploitation all describe how an incident begins. They are the equivalent of initial access techniques in conventional threat modeling and they compete with each other rather than accumulating, since one incident generally starts one way. Injection through retrieved content is the entry point with the widest reach among them.

‍

Some Are Propagation

‍

Tool misuse, identity and privilege abuse, unexpected code execution and insecure inter-agent communication describe what happens between the start and the damage. They are mechanisms rather than events, and their contribution is to severity rather than to frequency.

‍

Some Are Outcomes

‍

Cascading failures and rogue agents describe end states. A cascading failure is what several of the other categories produce when the conditions allow it, so treating it as an independent scenario counts the same underlying event a second time.

‍

Register Events, Not Threats

‍

The correction is to build the register from loss events and treat the taxonomy as the set of paths leading to each one. A loss event is something with a financial consequence, such as unauthorized payment, regulated data leaving the environment, or a critical process becoming unavailable.

‍

Frequency for that event aggregates across the paths that reach it. Severity comes from the event itself and what the agent could touch. Recorded this way, adding a new threat category to the taxonomy next year changes the frequency estimate for existing events rather than requiring a new register entry, which is the property that keeps the model stable as the taxonomy evolves.

‍

Mapping Preserves the Traceability

‍

The categories still belong in the record, attached to the scenario as contributing paths rather than as separate rows, which is a property a register built for decisions needs anyway. Attaching them preserves the audit trail back to a recognized framework, which is what an assessor asks for, without letting the taxonomy dictate the structure of the loss model. Chains where agents call other agents are where several paths converge on one event most often.

‍

Frequency Is Available for Some Paths and Not Others

‍

An honest model treats the ten differently on the frequency side, because some map onto mechanisms with observable histories and some do not.

‍

Identity and privilege abuse behaves like credential abuse generally, which is among the best-evidenced initial access categories in conventional cyber loss data. Supply chain compromise has documented precedent in package and registry attacks, and agents connecting to external tools has its own recording problem. Unexpected code execution has a long vulnerability history behind it. Those three can borrow base rates with adjustment.

‍

Goal hijack, memory poisoning and rogue behavior have no comparable history. Estimating their frequency from published incidents means working from a handful of demonstrations and disclosed cases, which supports a range rather than a point. Stating which paths rest on borrowed base rates and which rest on judgment is the difference between a defensible model and a confident one.

‍

Severity Is the Same Calculation Every Time

‍

The taxonomy varies enormously on the frequency side and barely at all on severity, because the consequence depends on the agent rather than on the technique.

‍

OWASP makes the same point directly, describing agentic risk as a blast radius problem where exposure equals every credential, tool and interface an agent can reach. Whether an agent was hijacked through a poisoned document or through a compromised peer, the damage it can do is bounded by the same set of permissions.

‍

Which Simplifies the Modeling Considerably

‍

Severity can be estimated once per agent and reused across every path, rather than re-derived per threat category. Doing it that way also makes the control argument obvious, since narrowing scope reduces the severity term for all ten categories at once while any input-side control addresses one path.

‍

A Worked Example

‍

Take an agent that processes supplier invoices and can initiate payments below a threshold.

‍

The loss event is an unauthorized payment. Paths to it include a poisoned invoice document redirecting the agent, a compromised peer agent passing a fraudulent instruction, abuse of the agent's own credentials by an external party, and a supply chain compromise in a tool it calls. Four paths, one event.

‍

Frequency is the sum across paths, with the credential path carrying a borrowed base rate and the document path carrying a judgment-based range. Severity is bounded by the payment threshold and the number of transactions possible before detection, which are both known numbers. Detection depends on behavioral monitoring in production being in place at all. The resulting figure is defensible because every input can be pointed at, and quantifying autonomous system risk follows the same structure for other agent types.

‍

The Model Immediately Suggests the Control

‍

Detection latency and the payment threshold are the two severity inputs, so lowering either reduces exposure more than any measure aimed at the four paths individually. The arithmetic is the practical argument for constraining what an agent can do rather than attempting to secure how it reasons.

‍

What the List Does Not Cover

‍

Two boundaries are worth stating so the model is not assumed to be complete.

‍

The agentic list extends rather than replaces the model-level list, so most agent systems inherit the underlying language model risks as well and both belong in the assessment. The taxonomy is also voluntary, carrying no legal standing by itself, so mapping to it evidences diligence and does not discharge any regulatory obligation. Conventional application vulnerabilities in the surrounding infrastructure sit outside it entirely and still need their usual treatment.

‍

A Taxonomy Is a Set of Paths

‍

The OWASP categories describe how agent incidents happen, which is exactly what a frequency estimate needs and exactly not what a risk register should be organized around. Building the register from loss events, attaching the categories as contributing paths, borrowing base rates only where the mechanism has a history, and estimating severity once per agent produces a model that survives the next revision of the taxonomy. Kovrr's AI risk quantification records scenarios with their mapped techniques alongside the modeled figures, so the traceability and the arithmetic sit in the same place.

‍

To see agent scenarios recorded with both their mapped techniques and their modeled exposure, book a demo mapped to your own estate.