SECAI Core · phase 8 of 15 · noun

Open Web Application Security Project

A charity and community publishing a number of secure application development resources.

The Explain card

Plain English
OWASP is a charity and open community that publishes free resources for building secure applications, from testing guides to well-known risk lists.
Example
A team building an LLM-powered helpdesk uses the OWASP Top 10 for LLM Applications as a checklist. It prompts them to test for prompt injection, insecure output handling, sensitive information disclosure and excessive agency before release.
Why it matters
OWASP distils community experience into practical, vendor-neutral guidance. For defenders of AI systems, it is often the quickest way to turn "we should secure this" into a concrete list of things to check.
Hook
The community cheat sheet for what attackers try first.

Word knowledge

How the word is built, where it came from, and what it sits beside in memory.

In a sentence

The threat model for the customer-facing chatbot maps each item in the Open Web Application Security Project Top 10 for LLM Applications to a test case in the staging suite.

Why these words
  • open Old English open, unshut marks the named effort as freely joinable rather than a closed vendor shop
  • web Old English webb, woven fabric locates the work on browser-facing programs rather than on networks or operating systems
  • application Latin applicatio, a joining to, from applicare, to attach names the software artifact being hardened, the program users run
  • security Latin securitas, freedom from care, from securus, without care supplies the purpose, so the stack is about keeping those programs safe
  • project Latin proiectum, something thrown forth, from proicere, to throw forward supplies the head noun, the organizational form the other four words describe
Where it came from
Origin
English coinage by Mark Curphey, from Old English open (unshut) and webb (woven fabric), Latin applicatio (a joining to), securitas (freedom from care), and proiectum (something thrown forth)
Entered the language
2001
What changed
Open had meant unshut, then freely available to join or copy. Web had meant woven cloth, then Berners-Lee's hypertext system. Application had meant a joining, then a software program. Security had meant freedom from care, then the work of keeping systems safe. Project had meant something thrown forward, then a planned undertaking. Curphey stacked the five in 2001 to name a community effort aimed at the then-new attack surface of programs that run in a browser.
How it is spelled
Pattern
ad- becomes ap- before p, doubling the p
Pattern
Latin iacere yields -ject after a prefix
Pattern
-ity nouns sit beside -e adjectives: security, secure
Pattern
each content word takes an initial capital in the proper-name title
Breaks the pattern
the five-word title stays a proper name, always capitalized
Breaks the pattern
project as a noun stresses the first syllable, unlike the verb
Breaks the pattern
web here is a clipping of World Wide Web, not the fabric sense, yet it keeps the short spelling
Breaks the pattern
application keeps plic from Latin, while apply writes ply

Spelled like

  • appear
  • injection
  • severity
Broken into chunks
  • open
    • opener
    • reopen
    • openly
  • web
    • website
    • cobweb
    • webbing
  • app
    • apply
    • appoint
    • append
  • plic
    • implicit
    • complicate
    • replica
  • ation
    • information
    • operation
    • combination
  • cur
    • curator
    • curious
    • procure
  • ity
    • integrity
    • availability
    • confidentiality
  • ject
    • inject
    • reject
    • object
What it sits beside

Same subject

Same shape

  • Open Source Initiative
  • Open Compute Project
  • Web Application Firewall
  • Cloud Security Alliance

Peer standards bodies

Application-security catalogues

  • OWASP Top 10
  • Application Security Verification Standard
  • OWASP Testing Guide

Open-named efforts

  • Open Source Initiative
  • Open Compute Project
  • Open Policy Agent

Where it sits in the deck

Phase 8: Governance, Risk, and Compliance Frameworks

Individual controls need a governance envelope — introduce the risk and compliance structures, standards bodies, and regulations that frame AI accountability at scale.

Neighbours in this phase