Technical self-check · about 4 to 6 minutes

AI & agent security

Review what the agent can do, not just what it says. Rate 12 original prompts as Operating, Partial, Planned, Not in place or Not sure, see your readiness by area, and get a remediation template for every gap. Everything stays in your browser.

12 prompts4 areas100% privateFree

Start this assessment See all 15

Scope. 12 original prompts for AI-enabled applications. No model testing, certification, exhaustive OWASP mapping or legal applicability determination. Reference: NIST AI Risk Management Framework (context only, not an endorsement).

What this assessment covers

The 12 prompts, grouped by area. Each one has a "what to look for" note and a concrete action inside the assessment.

Purpose

Is each AI use case inventoried with an accountable owner?
Are high-impact uses identified before deployment?
Are acceptable uses and prohibited inputs documented?

Data

Are sensitive inputs limited to approved systems and purposes?
Does retrieval enforce the requesting user’s access?
Can you remove or correct retained AI data where required?

Authority

Are tool actions authorized outside the model?
Do consequential actions require specific, reviewable approval?
Can agent credentials be revoked quickly?

Evaluation

Have untrusted-content and instruction-injection cases been tested?
Are failures logged without unnecessarily retaining sensitive content?
Is there a release decision and monitoring owner?

How scoring works. Only rated prompts count toward the index. Not sure and unanswered prompts are reported separately and never scored as a pass or a gap. Gaps are listed highest priority first, each with a link to a matching template in the open GRC Documentation Kit. This is a conversation starter, not an audit or a certification.

Start the AI & agent security assessment

Other assessments: NIST CSF 2.0 · ISO 27001 readiness · SOC 2 preparation · Cloud & identity · SOC & incident readiness · Small business security · Web & API release readiness · Supplier security review · Backup & recovery readiness · Secure software delivery · Identity & privileged access · Mobile release readiness · Data protection operations · Security culture & role readiness