AI Security Assessment for your clients

1. Do you know which AI tools and assistants employees use?

Recommendation: Run a discovery of AI apps and extensions in use before writing rules: policy written blind tends to ban what nobody uses and miss what everybody does.

2. Is there an acceptable-use policy for AI?

Recommendation: Publish a short AI acceptable-use policy naming approved tools, prohibited data and who approves new tools; ask employees to acknowledge it.

3. What keeps sensitive data out of prompts and uploads?

Recommendation: Add technical controls that inspect prompts and file uploads for regulated and confidential data, rather than relying on training alone.

4. Do employees have approved alternatives to consumer AI tools?

Recommendation: Provide an approved enterprise AI tool and a request path for new ones; bans without an alternative push usage into accounts you cannot see.

1. Is the purpose of each AI system written down?

Recommendation: Keep a short deployment record per AI workflow: approved purpose, data it can reach, actions it may and may not take, known limits and next review date.

2. Are there named owners with authority over each AI system?

Recommendation: Name a business owner, a technical owner and an operational owner who can suspend the service — an ownership label is useful only with authority and an escalation path.

3. What happens when someone adds a tool, data source or model?

Recommendation: Tie AI changes to change management: a new tool, data source, permission or model should require the same approval as the original deployment.

4. How is AI risk assessed?

Recommendation: Assess AI risk with a structure such as the NIST AI RMF, beyond security: reliability for the task and the effects on the people the system serves.

1. What identity do AI agents and integrations run under?

Recommendation: Give every agent its own managed identity; an agent on a manager's credentials can do everything the manager can before the model makes any mistake.

2. How are agent permissions scoped?

Recommendation: Scope permissions to the workflow and enforce resource and tenant boundaries in the service that owns the data; allowing a tool name is not enough.

3. Where do agent credentials live?

Recommendation: Move agent credentials out of prompts and configuration into a secret manager or workload identity, and prefer short-lived, scoped tokens.

4. Has removing an agent's access ever been tested?

Recommendation: Test revocation in a controlled environment: disable the agent and measure when access actually stops, including sessions, queued jobs and downstream connections.

1. Is there an inventory of the AI tools, MCP servers and models in use?

Recommendation: Keep an approved catalog of AI tools, MCP servers, models and retrieval sources, each with a named owner and the reason for admission.

2. How is a new tool or MCP server assessed before use?

Recommendation: Admit components on evidence: provenance, code where available and behaviour in an isolated test with synthetic data — a clean scan is a starting point.

3. Do you know which version of each component was approved?

Recommendation: Pin reviewed versions of self-managed components and monitor hosted ones for change; an approval is for an exact version doing an exact task.

4. Can you remove or roll back a component quickly?

Recommendation: Make removal and rollback part of the catalog process, so that discovering a problem produces an actionable response.

1. Can an agent that reads external content (email, documents, web) also take sensitive actions?

Recommendation: Separate workflows that read untrusted content from those with sensitive permissions; an instruction to 'ignore malicious content' does not replace control over what can execute.

2. Are tool calls validated before they execute?

Recommendation: Validate every proposed tool call server-side — field types, permitted values, tenant ownership and authority — before it executes.

3. Is content inspected for prompt injection and sensitive data?

Recommendation: Inspect inputs, tool results and outputs on the paths that need it, and decide what the workflow does when the inspection service is unavailable.

4. When a person approves an AI action, what do they see?

Recommendation: Bind human approval to the concrete action — recipient, content, data and effect — and require a new decision when those change.

1. Are agent actions recorded so an incident can be reconstructed?

Recommendation: Record each consequential agent action with its identity, context, policy decision and actual result, linked by correlation IDs across systems.

2. Is there a runbook to contain an AI agent?

Recommendation: Write a containment runbook listing every mechanism — identity, credentials, jobs, network, connectors — who controls it, and how to verify it worked; then exercise it.

3. Are AI controls tested again after changes?

Recommendation: Keep a repeatable test set with both misuse and legitimate tasks, and rerun it after material changes to models, instructions, tools or permissions.

4. Does anyone review AI security on a schedule?

Recommendation: Hold a monthly review with measures — audit coverage, misuse that succeeded, legitimate work blocked, time to contain — and end it with decisions.

1. Is joiner/mover/leaver automated from the HR system?

Recommendation: Automate joiner/mover/leaver against HR, including movers and contractors; every service account and agent is tied to a human whose access must be right first.

2. Do managers certify their team's access?

Recommendation: Run access certifications at least quarterly for critical systems and act on the revocations they produce.

3. How is privileged access controlled?

Recommendation: Bring privileged access under PAM with credential rotation, session recording and just-in-time access; every administrator compromise is also a compromise of the secrets that administrator can see.

4. Are service accounts, API keys and certificates inventoried with owners?

Recommendation: Inventory service accounts, keys and certificates with owners and rotation; without reliable ownership the lifecycle of non-human identities cannot work.