How to meet it
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · Edge & Distributed AI Security
Edge devices use strong authentication
Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.
OWASP AISVS v1.01, requirement 4.3.1
In plain English
Edge devices must prove who they are with strong credentials before they talk to your central systems.
What good looks like
- Each device has its own credential, ideally stored in hardware.
- Credentials can be revoked per device.
- Shared or default credentials are not used.
How teams usually do it
- Device certificates with mutual TLS, stored in a secure element or TPM.
Evidence an auditor would accept
- Device identity design and the revocation process.
Common mistakes
- One API key built into every device.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.