A city security architect must threat-model a resident chatbot before launch. Which resource is most appropriate for cataloging LLM application risks?

Threat-modeling a resident-facing municipal chatbot requires an LLM-specific risk catalog, not generic IT checklists alone. The OWASP LLM Top 10 provides shared categories for prompt injection, insecure output handling, training-data poisoning, model DoS, supply-chain issues, sensitive-information disclosure, insecure plugin design, excessive agency, overreliance, and related application risks. City security architects use it to enumerate abuse cases, map trust boundaries around retrieval and tools, and prioritize controls before launch. Anchoring the chatbot threat model in that taxonomy keeps discussions concrete and comparable across departments. Presenting the OWASP Top 10 as an LLM threat-modeling reference confuses it with the OWASP LLM Top 10 — the regular OWASP Top 10 catalogs web-application risks like broken access control and injection, not LLM-specific risks like prompt injection, training-data poisoning, or excessive agency. The MITRE ATLAS matrix catalogs adversary tactics and techniques against AI systems, which helps model attacker behavior, but it does not catalog LLM application risks for threat-model enumeration the way the OWASP LLM Top 10 does. The NIST AI RMF provides a governance-risk framework organized around Govern, Map, Measure, and Manage functions, not a catalog of LLM application risks like prompt injection or insecure output handling needed for chatbot threat modeling. Exam caveat: a mislabeled web-application list, an LLM adversary-tactic matrix, or an LLM governance-risk framework do not replace an LLM application-risk catalog for chatbot threat modeling. Operational check: walk the resident chatbot architecture against each OWASP LLM Top 10 item, record applicable threats and mitigations, and require residual-risk sign-off before production.