IA × IA / Assessment

AI Security Assessment

How fast can they hit you, and how fast do you defend.

v1.1 · Self-assessment, not an audit: it measures what you declare. No benchmark until there is real data. Stores only the numeric answers, under a random code. · Download the questions as CSV

Before you start

In 8 short steps you find out two things: how exposed you are to AI-powered attacks, and how fast your defense can respond. The gap between the two is what matters.

At the end you get a report with both scores, the five gaps that weigh most, a 90-day plan, the map to NIST, ISO 42001, OWASP and LGPD, and a code to repeat the assessment and see the evolution.

It takes about 6 minutes. No sign-up, nothing that identifies you is stored. Pick the level that describes today, not the plan.

Compare with a previous assessment (paste the code from the old report)

Step 1 of 8 · Exposure

Exposed AI surface

First, the size of the door: how many AI systems you have and who talks to them.

A1.1How many AI systems (assistants, agents, models via API) are in use, including unofficial ones?

1None in production

2One or two, known

3Several, inventoried

4Several, inventory incomplete

5We don't know how many (shadow AI)

Not applicable

A1.2Who talks to them?

1Internal technical staff only

2Employees in general

3Authenticated customers

4External public, no login

5External public and other AI agents

Not applicable

A1.3Through which channels?

1Internal interface only

2Own web or app

3Also email or chat (WhatsApp, Teams)

4Also an API open to third parties

5Also IDE/terminal with access to repositories and production

Not applicable

Step 2 of 8 · Exposure

Reach: what the AI can see and do

Now what's behind the door: what data the AI can reach and what it can do on its own.

A2.1What data can these systems reach?

1Only the conversation

2Non-sensitive internal documents

3Customer personal data

4Financial or health data

5Credentials, keys or production code

Not applicable

A2.2What actions do they execute with no human in the path?

1None, they only answer

2Create records or tickets

3Send emails or messages on behalf of the company

4Change accounts, permissions or settings

5Execute transactions, payments or code in production

Not applicable

A2.3Under which identity do they act?

1They don't act

2The user's identity, same privileges

3Own service account, minimal scope

4Broad service account, shared

5Administrator credentials or master keys

Not applicable

Step 3 of 8 · Exposure

Third parties and external agents

What comes in from outside: third-party tools, other companies' agents, and the content your agents read.

A3.1Third-party models, tools, MCPs and plugins used by your agents:

1None

2Few, approved and version-pinned

3Several, approved

4Several, no approval process

5Anything the team installs

Not applicable

A3.2Customer, partner or supplier agents interacting with your systems (calling in, hitting the API, negotiating):

1Doesn't happen and would be blocked

2Doesn't happen, no defined control

3Happens, treated as human

4Happens, no procedure

5We couldn't tell whether it already happens

Not applicable

A3.3External content your agents read (emails, documents, pages, tickets):

1None

2Only controlled internal sources

3External sources with filtering

4External sources without filtering

5Any content, including attachments from strangers

Not applicable

Step 4 of 8 · Exposure

Attacker speed against you

How much time an attacker has: your real containment time and whether you have tested your own AI.

A4.1Real time between a malicious access starting and someone containing it, today:

1Minutes, automated

2Under an hour

3Hours

4Days

5We don't measure

Not applicable

A4.2Testing of prompt injection, social engineering and excessive agency against your own AI systems:

1Continuous, automated

2Before every relevant change

3Once, at launch

4Never, but planned

5Never

Not applicable

A4.3Known public exposure (open vulnerabilities, leaked secrets, lookalike domains):

1Monitored and fixed within days

2Monitored, fixed within weeks

3Reviewed periodically

4Reviewed when someone reports it

5Not monitored

Not applicable

Step 5 of 8 · Defense

Detect

Now the defense. First, seeing: which signals arrive and who does the triage.

B1.1Signals feeding detection (WAF, SIEM, EDR, IAM, anti-fraud, pipeline, brand):

1One or none, checked manually

2Some, in separate consoles

3Centralized

4Centralized and correlated automatically

5Correlated, with business context, in real time

Not applicable

B1.2Alert triage:

1A human reads everything

2Rules discard predictable noise

3AI summarizes and prioritizes, human decides

4AI investigates and proposes an action with structured evidence

5AI investigates, proposes and learns from sampled human review

Not applicable

B1.3Detection of attacks against the AI itself (injection, system prompt extraction, tool misuse):

1None

2Logs, no analysis

3Basic alerts

4Dedicated monitoring

5Monitoring with automated response and kill switch

Not applicable

Step 6 of 8 · Defense

Decide

Deciding: who authorizes an agent's action and how authority is defined.

B2.1Who authorizes an action proposed by an agent?

1Always a human, case by case

2Human, with a queue and SLA

3Deterministic rules for the obvious, human for the rest

4Independent supervisor (another agent, with a narrow goal) evaluates the request; human by impact

5Supervisor with a verifiable contract, policy engine (fixed rules, outside the model) outside the model, human only for the irreversible

Not applicable

B2.2Is the agent's authority defined per action class (alone, supervisor, always human)?

1No matrix

2Exists, informal

3Documented per system

4Documented per action class, with reversibility and TTL (an expiry)

5Documented and technically enforced, with automatic reduction when verdicts diverge

Not applicable

B2.3Before granting autonomy to an action class, are the agent's decisions compared against independent review?

1No

2Ad hoc tests

3Pilot in recommendation mode

4Shadow mode (the agent decides but only records, and someone compares) with a reviewed sample

5Shadow mode with a defined threshold and window, recorded in the contract

Not applicable

Step 7 of 8 · Defense

Act

Acting: what already runs with no human in the path, how fast, and how it is undone or stopped.

B3.1Actions already running with no human on the critical path:

1None

2Enrichment and correlation

3Low-impact reversible ones (IP block with TTL, session revocation)

4Also medium containment (isolate host, hold transaction) with a supervisor

5Everything reversible and within policy; human only for the irreversible

Not applicable

B3.2Time from signal to containment action, in the automated flows:

1No automated flow

2Hours

3Tens of minutes

4Minutes

5Under a minute, measured

Not applicable

B3.3Reversibility and shutdown:

1No way to undo or stop without technical intervention

2Undo is manual

3Actions have a TTL and can be reverted

4There is also a kill switch outside the agent

5Kill switch (stop button) tested, state recorded, nothing executes after the stop

Not applicable

Step 8 of 8 · Defense

Govern

Governing: each agent's identity, metrics and playbooks per challenge family.

B4.1Identity and accountability of each agent (badge: identity, context, access, authority, supervision, evidence, validity):

1None

2Informal owner

3Owner and access documented

4Full badge per agent

5Badge technically enforced and reviewed on schedule

Not applicable

B4.2Metrics:

1None

2Alert volume

3Detection and response time

4Also verdict precision and reversal rate

5Also cost per decision and agent-vs-review divergence, over time

Not applicable

B4.3Defense playbooks per challenge family (SOC, fraud, AppSec, identity, brand):

1None

2Manual procedures

3Written playbooks, manual execution

4Playbooks with an authority matrix, partially automated

5Automated playbooks, tested and reviewed on every change

Not applicable

Your result

Before the result, one optional question:

Industry (optional, aggregate statistics only)

How to read it: Exposure runs from 1 (barely exposed) to 5 (very exposed). Defense runs from 1 (all manual) to 5 (the agent acts alone, within limits and with governance). The gap between them tells whether you are attacked at machine speed and defending at human speed.

A · Exposure–1 low · 5 high

B · Defense–1 manual · 5 agent within limits

Gap A − B–answer to see

Quadrant–0 of 24 answered

Content provided without warranties: use it as context and validate it in your environment. Labels say what the author could verify and what is a proposal. Disclaimers and license →