PART 4Prevention
Slides 18–25 · Six mitigation categories
Slide 18 · Prevention Overview
Six control categories. Each closes a different gap.
OWASP’s recommended mitigations for LLM10:2025, laid out before we go deep.
M1
Input Validation & Token Limits
Cap what comes in and what goes out at the request level.
M2
Rate Limiting Tied to Token Consumption
Rate limit by tokens per minute, not just requests per minute.
M3
Resource Consumption Quotas
Per-user, per-session, and per-day cumulative spending limits.
M4
API Gateway Controls & Budget Alerts
Enforce limits at the infrastructure layer; fire alerts before the bill arrives.
M5
Monitoring & Anomaly Detection
Watch token-per-request trends and per-user spend in real time.
M6
Agentic Safeguards
Maximum step counts, execution timeouts, and loop-detection for autonomous agents.