Short answer: use the free frameworks to decide what to manage, and use templates when you want ready-to-fill documents and scripts to do it faster. OWASP's Top 10 for LLM Applications and NIST's AI Risk Management Framework are free, authoritative and widely referenced. Agent Field Kit's templates are paid, practical starting points that reference them; they don't replace them.
The free options
- OWASP Top 10 for LLM Applications: a ranked list of LLM application risks, with prompt injection first (LLM01:2025), plus descriptions and mitigations.
- NIST AI Risk Management Framework (AI RMF 1.0): a voluntary framework organised around four functions, Govern, Map, Measure and Manage, with a companion Playbook and a Generative AI Profile (NIST AI 600-1).
When to use which
| You need to… | Start with |
|---|---|
| Agree on which risks matter and use shared terms | OWASP Top 10 and NIST AI RMF (free) |
| Set up an organisation-wide AI risk programme | NIST AI RMF and its Playbook (free) |
| Run prompt-injection tests against your agent this week | Prompt-Injection Test Pack |
| Audit an agent deployment and produce an evidence-backed report | Agent Security Audit Kit (controls mapped to OWASP and NIST AI RMF) |
| Put an incident process in place for agents | Incident Runbooks |
| Vet an AI vendor before purchase | Vendor Security Questionnaire |
| Estimate cost and ROI before rollout | Cost & ROI Calculator |
Trade-offs
Free frameworks are broad and stay current, but you write the documents, test cases and scripts yourself. Templates are narrower and cost money ($29 per template, $79 for the Audit Kit), but come as editable files you can adapt in an afternoon. If you have the time and in-house expertise, the free frameworks may be all you need. All Agent Field Kit purchases have a 14-day refund.
FAQ
Are OWASP and NIST AI RMF free?
Yes. Both are free to read and use.
Do I need paid templates if I use NIST AI RMF?
Not necessarily. The framework describes outcomes to achieve; templates save time if you want ready-made documents, checklists and scripts to produce the evidence.
Does Agent Field Kit replace OWASP or NIST?
No. The kits reference them and are meant to be used alongside them.