Generative AI.

What is generative AI?

Generative AI is a kind of artificial intelligence that creates new content, such as text, images, audio or video. The NIST glossary defines it as the class of AI models that emulate the structure and characteristics of input data in order to generate derived synthetic content. Synthetic content means content made by a model, not by a person. The glossary cites NIST SP 800-218A for this definition and uses the short form GenAI.

How does generative AI work?

In the NIST definition, a model takes in data and learns its structure and characteristics. It can then produce new content that follows the same patterns. Large language models, often shortened to LLMs, are one common type. They work with text. OWASP uses the phrase “LLMs and Gen AI Apps” for the systems and applications built on them.

A simple illustration: a person types a question into a chat tool, and the model writes a draft answer in plain language.

Why does generative AI matter for security?

NIST published the AI Risk Management Framework: Generative AI Profile (NIST AI 600-1) on 26 July 2024. It is a companion to the NIST AI Risk Management Framework (AI RMF 1.0). NIST says its aim is to improve the ability of organizations to build trustworthiness considerations into the design, development, use and evaluation of AI products, services and systems.

OWASP publishes a Top 10 list of risks for LLM and generative AI applications. The 2025 list names these items:

• Prompt injection
• Sensitive information disclosure
• Supply chain
• Data and model poisoning
• Improper output handling
• Excessive agency
• System prompt leakage
• Vector and embedding weaknesses
• Misinformation
• Unbounded consumption

The UK NCSC says agentic systems built on language models inherit known risks, such as jailbreaking and prompt injection.

How can organizations reduce the risk?

The sources above are frameworks and risk lists, so they give a way to organize the work. NIST AI 600-1 is voluntary and is meant to support trustworthiness in how AI is designed, developed, used and evaluated. The OWASP list gives teams a set of named risks to check applications against. The NCSC advises meaningful human oversight and control of agentic systems.

How does generative AI relate to nearby terms?

The NCSC describes agentic systems as advanced generative AI. An AI agent is software that uses a model to act towards a goal. Staff use of AI tools without approval is often called shadow AI. A deepfake is synthetic media that imitates a real person, and it is one kind of content a generative model can produce.

Is generative AI the same as AI?

No. AI is the wider field. Generative AI is the class of models, in the NIST definition, that create new synthetic content from patterns in input data.

Is a large language model the same as generative AI?

Not exactly. A large language model is one type of generative model, built for text. Generative AI also covers models that produce images, audio and video.