OWASP Tells You What's Wrong. We Built the Framework for How to Fix It.

Three months ago we open-sourced our attack taxonomy. It now covers 168 attack vectors. The taxonomy answers one question: what can go wrong?

Naming the problem is not enough. A security team that can name 168 attacks still has to decide which defenses to build first. It has to know when a heuristic is sufficient and when a formal guarantee is worth the cost. It needs a way to take a rule of thumb and harden it step by step until it holds.

Existing frameworks did not answer those questions. So we wrote one that tries to.

Today we are open-sourcing the Evolutionary Security Framework (ESF), a ten-phase maturity model for progressively hardening agentic AI security systems. It is on GitHub at tachyonic-sh/esf.

The Gap

OWASP defines the AI threat landscape well. The LLM Top 10 catalogs the most critical risks for LLM applications. The Agentic Top 10 extends that to autonomous agents: goal hijacking, tool misuse, privilege escalation and cascading failures.

These are threat catalogs. They tell you what exists at the surface. They do not tell you how to mature your defenses against each risk until it is structurally removed.

Other maturity models (Darktrace, Microsoft Well-Architected, Legit Security) measure organizational AI readiness. They ask how well your team uses AI in its SOC. That is a useful question. It is not the same as asking how well your system understands and structurally prevents its own threat surface.

The ESF targets that second question. It is a maturity model for the security knowledge itself: how understanding moves from naming threats to proving they cannot occur.

The Ten Phases

The ESF describes a sequential progression. Each phase converts uncertainty into structure.

Name → Relate → Guess → Measure → Model → Explain → Formalize → Constrain → Prove → Evolve

Name: classify every threat, asset and action. You cannot reason about what you cannot name.
Relate: map how everything connects. Attack chains, trust boundaries, dependency graphs.
Guess: deploy fast, imperfect rules of thumb. Imperfect action beats perfect analysis.
Measure: test the rules against reality. An untested heuristic is a superstition.
Model: let data reveal patterns intuition missed.
Explain: identify root causes, not only symptoms.
Formalize: encode the most important invariants as deterministic rules.
Constrain: make violations structurally impossible, not just detectable.
Prove: for the highest-consequence properties, verify correctness formally.
Evolve: new threats restart the cycle at a higher baseline.

Not everything needs to reach Phase 9. We call this the funnel principle. Most security properties should stay heuristics. Only the highest-consequence properties at critical trust boundaries justify formal verification. The framework gives decision criteria for which properties to push further.

How It Relates to OWASP

The ESF builds on OWASP. It does not compete with it.

OWASP defines what risks exist. The ESF describes how to harden against them over time.

The repository maps ESF phases to the OWASP Agentic Top 10, the OWASP LLM Top 10 and MITRE ATLAS. For example, prompt injection (LLM01):

Phase 1: classify 20 injection subtypes (direct override, encoding bypass, indirect via retrieval)
Phase 3: deploy input validation heuristics and output scanning
Phase 4: red-team the heuristics to find which variants bypass them
Phase 6: identify the root cause, which is instruction and data channel conflation
Phase 8: separate instruction and data channels in the architecture
Phase 9: formally verify that no code path lets untrusted input reach the instruction channel

The framework mappings in the repository give this breakdown for each covered risk.

The Maturity Rubric

The ESF includes a scoring rubric that rates each phase from 0 to 4. The result is a maturity profile for a system.

Common profiles:

Reactive: ad-hoc heuristics with no measurement. The team has guardrails but cannot quantify their effectiveness.

Operational: strong detection and measurement (Phases 1-5) with limited causal understanding and no formal guarantees. Good at catching known threats. Blind to root causes.

Hardened: formal rules and structural constraints exist (Phases 7-8) but were not derived from causal analysis. The rules hold until the threat landscape shifts.

Mature: coverage across the spectrum, with formal verification applied selectively to the highest-consequence properties. This is rare, and it should be. The cost is justified only for critical systems.

The quick-start guide walks through a 30-minute self-assessment.

Worked Example

The framework came out of our own tooling.

Our 168-attack taxonomy is the Phase 1-3 reference implementation: naming, relating and initial heuristics. Our research pipeline serves as a worked example for Phases 4-10. It combines a 14-heuristic triage engine written in Rust, an AI analyst for causal reasoning, enforced evidence integrity, and a loop that proposes triage improvements after each campaign.

The pipeline mapping shows how each stage maps to ESF phases. It is a self-assessment, not an independent audit. It includes our own scores and names the gaps, including Phase 9, where we have no formal verification yet.

What's in the Repository

The esf repository contains:

The specification: all ten phases with definitions, principles, anti-patterns, decision criteria and worked examples
Maturity rubric: machine-readable scoring criteria (YAML), maturity profiles and gap analysis templates
Framework mappings: ESF phases mapped to the OWASP LLM Top 10, the OWASP Agentic Top 10 and MITRE ATLAS
Decision guides: which phase to invest in next, whether to formalize a property or keep it heuristic, and when a property is ready for formal verification
Worked examples: prompt injection and privilege escalation traced through all ten phases
Pipeline mapping template: map your own system to the ESF

Everything is Apache 2.0.

What's Next

This is v0.1.0, a draft specification. It will change as we and others apply it to more systems and find where it needs refinement.

Contributions we would especially value:

Assessment feedback: apply the rubric to your system and report what worked
Worked examples: trace a specific threat through all ten phases
Framework mappings: map the ESF to NIST AI RMF, ISO 27001 or STRIDE
Phase refinements: improve definitions or anti-patterns from practitioner experience

Get Started

Read the ten-phase overview (5 minutes)
Score your system (30 minutes)
Map your pipeline to find coverage and gaps

Where Tachyonic Fits

We build security runtimes for AI agents and MCP systems. A runtime runs attack patterns from the public taxonomy against your agent or MCP server and returns reproducible findings with a signed evidence bundle. What a run covers depends on the target and the scope you set.

The free tier covers your first runtimes, and the quickstart takes minutes. To scope testing against a specific agent surface, book a 15-minute call.