How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Compromise Containment & Automated Remediation
Exercise automated remediation yearly
Verify that automated remediation is tested in tabletop or live-fire exercises at least once a year. The scenarios include a prompt-injected reviewer bot, fork-PR secret exfiltration, and an AI-generated malicious workflow file.
OWASP AISVS v1.01, requirement AC.14.5
In plain English
Test automated remediation at least once a year with tabletop or live exercises, including a prompt-injected review bot, secret theft through a fork PR and a malicious AI-generated workflow file.
What good looks like
- Exercises run at least yearly.
- They cover the listed scenarios.
- Lessons are tracked to completion.
How teams usually do it
- Tabletop sessions plus controlled live tests in a sandbox organisation.
Evidence an auditor would accept
- Exercise reports and follow-up actions.
Common mistakes
- Exercises that test detection but not remediation.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.