AI Security Readiness Scorecard

1. 1 / 15 Inventory

   Question 1's wording is not finalised yet.

   You cannot secure what you have not counted. Shadow AI appeared in 43% of breached organizations in IBM's 2026 study, up from 20%.

   Yes Partly No
2. 2 / 15 Inventory

   Question 2's wording is not finalised yet.

   Excessive Agency moved to third in the OWASP LLM Top 10 for 2026. An agent that can act is a privileged user.

   Yes Partly No
3. 3 / 15 Inventory

   Question 3's wording is not finalised yet.

   Retrieval turns your own document store into an untrusted input channel. Indirect injection is planted in content you own.

   Yes Partly No
4. 4 / 15 Controls

   Question 4's wording is not finalised yet.

   A WAF inspects structure. A prompt injection is well-formed text. They are different problems and one control does not cover both.

   Yes Partly No
5. 5 / 15 Controls

   Question 5's wording is not finalised yet.

   Published research reports evasion of up to 100% against production model-based guardrails (Hackett et al., LLMSec 2025).

   Yes Partly No
6. 6 / 15 Controls

   Question 6's wording is not finalised yet.

   Invariant Labs demonstrated exfiltration succeeding even with user confirmation, because the interface hid the tool arguments.

   Yes Partly No
7. 7 / 15 Controls

   Question 7's wording is not finalised yet.

   Sysdig observed roughly $50,000 of stolen compute in 4.5 days from a single monitored proxy. Monthly alerts run too slowly to matter.

   Yes Partly No
8. 8 / 15 Controls

   Question 8's wording is not finalised yet.

   Sensitive Information Disclosure is second in the OWASP LLM Top 10 for 2026. Egress is half the attack surface.

   Yes Partly No
9. 9 / 15 Validation

   Question 9's wording is not finalised yet.

   Attack techniques change monthly. MITRE ATLAS now ships monthly content releases. A test from last year describes last year.

   Yes Partly No
10. 10 / 15 Validation

    Question 10's wording is not finalised yet.

    Models get swapped, agents get new tools and prompts get rewritten. Each of those invalidates the previous test.

    Yes Partly No
11. 11 / 15 Validation

    Question 11's wording is not finalised yet.

    A guardrail that catches the OWASP sample payloads and fails against character injection is a false sense of security.

    Yes Partly No
12. 12 / 15 Evidence

    Question 12's wording is not finalised yet.

    Every regulatory regime in force converges on the same demand: evidence, not assurance.

    Yes Partly No
13. 13 / 15 Evidence

    Question 13's wording is not finalised yet.

    This is the question that starts most AI security programs, usually about a week too late.

    Yes Partly No
14. 14 / 15 Governance

    Question 14's wording is not finalised yet.

    68% of breached organizations in IBM's 2026 study had no completed AI governance policy, up from 63%.

    Yes Partly No
15. 15 / 15 Governance

    Question 15's wording is not finalised yet.

    Unowned risk becomes everyone's problem at exactly the wrong moment.

    Yes Partly No

Fifteen questions, each worth up to ten points, 150 points total, normalised to 100. Weighting is even by design. The three-point answer scale (Yes, Partly, No) is our own interpretation of the scoring method — the arithmetic is fixed, the answer options are not.