AI Security Readiness

Twenty-three questions to set one honest baseline.

An interactive self-assessment for CISOs and security leaders. Tick the boxes you can answer with evidence. As you go, the dashboard surfaces where the gaps are and what they mean.

Start the checklist Book a conversation

0 / 23

Diagnosis

Tick a question to begin.As you check boxes, the diagnosis updates with the pattern that best fits your current state.

Next steps

Tick the questions you can answer with evidence. Practical, prioritised actions for your pattern will appear here.

Want a quantified version of this with evidence? Talk to us.Book a conversation

Visibility

Weak0 / 6

Risk Assessment

Weak0 / 6

Governance

Weak0 / 6

Board Readiness

Weak0 / 5

Set the baseline

Turn this checklist into a board-ready posture score.

A 30-minute conversation to map your AI estate, define the gaps that matter, and outline a path from this checklist to a quantified Security Posture Score.

Book a conversation

Self-assessment · Results report

AI Security Readiness

Your readiness baseline.

Twenty-three questions across four dimensions of AI security readiness. The pattern of gaps tells you more than the count.

Your score

0/ 23

0% complete

For

CISO & Security Leaders

Diagnosis

Tick a question to begin.

Generated

Self-assessment · SummaryHumanbound · Report

01 / What the pattern says

Tick a question to begin.

As you check boxes, the diagnosis updates with the pattern that best fits your current state.

02 / Section breakdown

Visibility

0/ 6

Weak

Risk Assessment

0/ 6

Weak

Governance

0/ 6

Weak

Board Readiness

0/ 5

Weak

Want a quantified version of this with evidence? Discuss results at humanbound.ai/contact.

Humanbound · humanbound.ai02

Self-assessment · Your answersHumanbound · Report

04 / Your answers

What you ticked, what you didn't.

Ticked boxes represent items you can answer with evidence today. Unchecked boxes are areas that need attention.

Visibility

0 / 6 · Weak

Do we have a complete inventory of all AI systems in production, including vendor-embedded AI features?
Do we know what data each AI system can access (customer PII, financial records, source code, internal documents)?
Do we know what actions each AI system can take (respond only, or execute transactions, modify records, call APIs)?
Do we have visibility into Shadow AI usage across the organization?
Do we know how frequently our AI systems change (prompt updates, model swaps, new data sources)?
Is there a defined process for security sign-off before new AI systems reach production?

Risk Assessment

0 / 6 · Weak

Have we conducted adversarial testing aligned to OWASP standards (direct and indirect prompt injection, multi-turn manipulation, role manipulation, tool abuse)?
Do our existing security tools (firewall, SIEM, DLP) cover AI-specific threat vectors?
Do we have a quantified posture score we could present to the board today?
Are we monitoring AI behavior in production on an ongoing basis (not just uptime, but scope compliance and data handling)?
Do we have an incident response plan specifically for AI-related events?
Have we assessed the risk of AI agents with tool and API access being manipulated into unauthorized actions?

Continued on the next page with governance and board readiness.

Humanbound · humanbound.ai03

Self-assessment · Your answersHumanbound · Report

04 / Continued

Governance and board readiness.

Governance

0 / 6 · Weak

Do we have an AI security policy that covers both sanctioned and unsanctioned AI usage?
Is there clear ownership of AI security within the organization (not just AI development)?
Are AI systems included in our existing compliance and audit programs (SOC 2, ISO 27001, ISO 42001, DORA, NIS2, EU AI Act, FCA)?
Do we evaluate AI security when selecting or renewing SaaS vendors that embed AI features?
If we are evaluating AI security vendors, can they test against our actual business context rather than generic vulnerability catalogs?
Does our security testing keep pace with how frequently our AI systems change?

Board Readiness

0 / 5 · Weak

Can we answer "how many AI systems do we have and who controls them?" with evidence?
Do we have a quantified posture score with a trend line?
Can we articulate our top AI risks in business terms (data exposure, regulatory liability, customer impact)?
Do we have audit-ready reports with test results and lifecycle tracking?
Do we have a clear roadmap from current state to target state for AI security?

Discuss results

humanbound.ai/contact

Generated · humanbound.ai/ai-readiness

Humanbound · humanbound.ai04