What are the system requirements for Humanbound?

Humanbound requires Python 3.10 or higher, an LLM provider API key (OpenAI, Anthropic, Azure, or others) or Ollama for full local isolation, and an AI agent endpoint to test against.

How do I install Humanbound with local engine support?

Run pip install "humanbound[engine]" to include the local testing engine with OpenAI, Anthropic, and Google SDK support. The base pip install humanbound installs the CLI without the local engine extras.

What optional extras can I install with Humanbound?

Three extras are available: engine adds the local testing engine, firewall adds firewall training with scikit-learn and torch, and mcp adds an MCP server for AI coding assistants.

Do I need an API key to run tests?

You need an LLM provider API key (OpenAI, Anthropic, Azure, or others) for cloud-based testing, but you can use Ollama with no API key for full local isolation.

How do I verify my Humanbound installation?

Run hb --version to confirm the CLI is installed and hb --help to see all available commands.

Copilot Readiness

Twenty-nine questions to set one honest Copilot baseline.

An interactive self-assessment for technology, IT, and security leaders. Tick the boxes you can answer with evidence. As you go, the dashboard surfaces where the gaps are and what they mean.

Start the checklist Book a conversation

0 / 29

Diagnosis

Tick a question to begin.As you check boxes, the diagnosis updates with the pattern that best fits your current state.

Next steps

Tick the questions you can answer with evidence. Practical, prioritised actions for your pattern will appear here.

Want a quantified version of this with evidence? Talk to us.Book a conversation

Copilot Estate Visibility

Weak0 / 5

Configuration & Controls

Weak0 / 7

Testing & Validation

Weak0 / 6

Compliance & Evidence

Weak0 / 5

Operating Model

Weak0 / 6

Set the baseline

Turn this checklist into a board-ready Copilot posture.

A 30-minute conversation to map your Copilot estate, define the gaps that matter, and outline a path from this checklist to evidenced controls and audit-ready reporting.

Book a conversation

Self-assessment · Results report

Copilot Readiness

Your readiness baseline.

Twenty-nine questions across five dimensions of Microsoft 365 Copilot readiness. The pattern of gaps tells you more than the count.

Your score

0/ 29

0% complete

For

Technology, IT & Security Leaders

Diagnosis

Tick a question to begin.

Generated

Self-assessment · SummaryHumanbound · Report

01 / What the pattern says

Tick a question to begin.

As you check boxes, the diagnosis updates with the pattern that best fits your current state.

02 / Section breakdown

Copilot Estate Visibility

0/ 5

Weak

Configuration & Controls

0/ 7

Weak

Testing & Validation

0/ 6

Weak

Compliance & Evidence

0/ 5

Weak

Operating Model

0/ 6

Weak

Want a quantified version of this with evidence? Discuss results at humanbound.ai/contact.

Humanbound · humanbound.ai02

Self-assessment · Your answersHumanbound · Report

04 / Your answers

What you ticked, what you didn't.

Ticked boxes represent items you can answer with evidence today. Unchecked boxes are areas that need attention.

Copilot Estate Visibility

0 / 5 · Weak

Has Agent 365 been enabled in our tenant?
Do we have a complete inventory of every Copilot Studio agent in production, including who built each one and who owns it?
Do we know which data sources each Copilot Studio agent connects to and which APIs and connectors it has permission to call, including agents published from Azure AI Foundry into Copilot?
Do we have visibility into how many employees are actively using Microsoft 365 Copilot, what data they are querying, and what actions it is taking on their behalf?
Has shadow agent discovery been run on managed devices to identify unsanctioned agents?

Configuration & Controls

0 / 7 · Weak

Are sensitivity labels applied consistently across the SharePoint sites, OneDrive folders, and Teams content that Copilot can access?
Have DLP policies been configured specifically for AI-mediated data flows, not just email and file transfers?
Are Conditional Access policies applied to Copilot Studio agents, including both delegated-access and own-access agents?
Have topic restrictions and content filters been configured for each Copilot Studio agent in production?
Has connector and permission scoping been reviewed for each Copilot Studio agent to ensure least-privilege access?
Has SharePoint oversharing been assessed and remediated before or alongside Copilot rollout?
Do we know which agents Microsoft 365 Copilot can orchestrate, and have policies been set for which agents are permitted?

Continued with testing, compliance and operating model on the next pages.

Humanbound · humanbound.ai03

Self-assessment · Your answersHumanbound · Report

04 / Continued

Testing and compliance.

Testing & Validation

0 / 6 · Weak

Have any Copilot Studio agents been tested against prompt injection, including hidden instructions in documents, emails, or data sources the agent processes?
Have any Copilot Studio agents been tested for multi-turn manipulation, where a conversation gradually erodes adherence to system instructions?
Have any Copilot Studio agents been tested for tool-use abuse, where connector calls are chained in unintended ways to escalate scope or leak data?
Have any Copilot Studio agents been tested for business-rule violations specific to your domain, such as unauthorized commitments, compliance scope violations, or data handling outside policy?
Has Microsoft's AI Red Teaming Agent in Foundry been used to scan Copilot Studio agents for content safety risks?
If Microsoft 365 Copilot orchestrates multiple agents to complete a task, has the combined behavior across the chain been validated?

Compliance & Evidence

0 / 5 · Weak

Can we produce an audit trail showing what data Copilot has accessed and on whose behalf, for the retention period our regulations require?
Have we completed a Data Protection Impact Assessment for our Copilot deployment?
Have we mapped our Copilot deployment to the specific obligations under DORA, NIS2, or the EU AI Act that apply to our sector?
Are Copilot-related activities included in our existing compliance and audit programs (SOC 2, ISO 27001, ISO 42001)?
Can we produce evidence of adversarial testing results mapped to OWASP LLM Top 10 categories if asked by an auditor?

Operating model continues on the next page.

Humanbound · humanbound.ai04

Self-assessment · Your answersHumanbound · Report

04 / Continued

Operating model.

Operating Model

0 / 6 · Weak

Is there a defined sign-off process before a new Copilot Studio agent reaches production?
Is there clear ownership of Copilot governance within the organization, distinct from Copilot development?
Is there a defined cadence for re-reviewing the Copilot estate as Microsoft ships new capabilities and as agents change?
Does our security testing keep pace with how frequently Copilot Studio agents are created or modified?
If a new Copilot Studio agent is deployed tomorrow, is the process by which it reaches production documented?
When Microsoft ships new agentic capabilities in M365 Copilot, is there a defined process to review the governance and security implications before they are enabled?

Discuss results

humanbound.ai/contact

Generated · humanbound.ai/copilot-readiness

Humanbound · humanbound.ai05