---
title: Threat types
description: Threat types available in a Threat Response policy.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/intelligent-experiences/gov-pol-threat-categories.html
release: australia
topic_type: reference
last_updated: "2026-08-27"
reading_time_minutes: 1
keywords: [ServiceNow Otto, AI Agents, generative AI, agentic AI, Policies, Threat Response, threat type]
breadcrumb: [Reference, Controlling AI asset usage, Govern AI assets, AI Control Tower, Enable AI experiences]
---

# Threat types

Threat types available in a Threat Response policy.

|Threat type|Description|
|-----------|-----------|
|**Agentic Goal Deviation**|An agent's actions diverge from the objective it was given.|
|**Data and Model Poisoning**|Training data or a model's behavior has been tampered with.|
|**Excessive Agency**|An agent takes actions or accesses systems and data beyond what its task requires.|
|**Improper Output Handling**|A model's output is used downstream in a way that introduces risk, such as executing unvalidated content.|
|**Prompt Injection**|Untrusted input manipulates a model into ignoring its original instructions.|
|**Sensitive Information Disclosure**|A model exposes confidential, personal, or restricted data in its output.|
|**System Prompt Leakage**|A model reveals its own underlying instructions or configuration.|

**Parent Topic:**[AI Control Tower policies reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/intelligent-experiences/gov-pol-reference.md)