0 / 24

Model 50 of 74 · Cybersecurity

AI Security Maturity Assessment

Assess how well your organisation secures AI systems across their full lifecycle.

Pillars & areas

Assess

Understand the risks

  1. 01AI Threat Modelling & Risk Assessment
  2. 02Training Data & Pipeline Security

Harden

Secure the lifecycle

  1. 03Model Security & Integrity
  2. 04Inference & Runtime Security

Defend

Watch & respond

  1. 05AI Access Control & Governance
  2. 06AI Monitoring & Incident Response

Levels

  1. 1UnguardedNo AI-specific controls
  2. 2Risk-AwareThreats identified & controlled
  3. 3HardenedBuilt into the lifecycle

01 AI Threat Modelling & Risk Assessment

Does the organisation systematically identify and evaluate threats specific to its AI and ML systems?

0/4 answered

TR-1How does your organisation identify attack surfaces specific to its AI and ML systems?

Think about whether anyone has mapped out where AI systems could be attacked — training pipelines, model endpoints, data stores — or whether AI is treated like any other software.

TR-2How does your organisation perform threat modelling for AI-specific risks?

Consider whether threat models explicitly cover risks like data poisoning, model extraction, adversarial inputs, and prompt injection — not just generic application threats.

TR-3How does your organisation assess the business impact of AI-specific security failures?

Think about whether anyone has evaluated what happens if a model is compromised, produces manipulated outputs, or leaks sensitive training data.

TR-4How does your organisation track the evolving landscape of AI-specific threats?

Consider whether anyone monitors for new AI attack techniques, published vulnerabilities in ML frameworks, or emerging adversarial methods.

02 Training Data & Pipeline Security

Does the organisation protect the integrity and provenance of the data used to train and fine-tune its models?

0/4 answered

DP-1How does your organisation track the provenance and lineage of training data?

Think about whether you can trace where training data came from, who processed it, and whether it has been modified since collection.

DP-2How does your organisation detect and prevent training data poisoning?

Consider whether anyone checks for malicious or manipulated samples in training data, or whether data is trusted implicitly once collected.

DP-3How does your organisation control access to training data and ML pipelines?

Think about whether training data stores and pipeline configurations are protected by access controls, or whether anyone on the data team can modify them freely.

DP-4How does your organisation ensure the integrity of data flowing through ML pipelines?

Consider whether data is validated at each stage of the pipeline, or whether corrupted or tampered data could flow through to model training undetected.

03 Model Security & Integrity

Are models themselves protected from theft, tampering, and supply chain compromise?

0/4 answered

MS-1How does your organisation protect model weights and architectures from unauthorised access?

Think about whether trained models are stored securely with access controls, or whether anyone with network access could copy the model files.

MS-2How does your organisation test models for adversarial robustness before deployment?

Consider whether models are tested with adversarial inputs designed to cause misclassification or unsafe outputs before they go into production.

MS-3How does your organisation manage model signing and version integrity?

Think about whether you can verify that a model in production is the exact version that was approved, or whether models could be swapped or tampered with undetected.

MS-4How does your organisation vet third-party and open-source models before use?

Consider whether models downloaded from public repositories or obtained from vendors are evaluated for security risks such as backdoors, embedded biases, or licence violations.

04 Inference & Runtime Security

Are AI systems protected while serving predictions or generating outputs in production?

0/4 answered

RS-1How does your organisation defend against prompt injection and input manipulation attacks?

Think about whether AI systems that accept natural language or user-controlled inputs have defences against instructions designed to override their intended behaviour.

RS-2How does your organisation validate and filter AI system outputs before they reach end users?

Consider whether model outputs are checked for harmful content, data leakage, or hallucinated information before being presented to users or fed into downstream systems.

RS-3How does your organisation protect model endpoints from extraction and abuse?

Think about whether model APIs have rate limiting, authentication, and monitoring to prevent attackers from systematically querying the model to reconstruct it or harvest its training data.

RS-4How does your organisation validate inputs to AI systems to prevent evasion and misuse?

Consider whether AI systems check that inputs conform to expected formats and distributions, or whether any input — no matter how anomalous — is processed without question.

05 AI Access Control & Governance

Does the organisation control who can deploy, modify, and interact with AI systems within defined boundaries?

0/4 answered

AG-1How does your organisation manage approval and authorisation for deploying AI models to production?

Think about whether anyone can push a model to production, or whether there is a defined approval workflow with security sign-off.

AG-2How complete and current is your organisation's registry of AI models in production?

Consider whether you have a single source of truth listing every AI model running in production, or whether models are deployed across teams without central visibility.

AG-3How does your organisation manage role-based access to AI model endpoints and management interfaces?

Think about whether access to invoke models, retrain them, or modify their configuration is controlled by role, or whether permissions are broad and undifferentiated.

AG-4How does your organisation define and enforce permission boundaries for AI agents and autonomous systems?

Consider whether AI agents that take actions (sending emails, modifying data, calling APIs) operate within defined boundaries, or whether they have unconstrained access to tools and data.

06 AI Monitoring & Incident Response

Can the organisation detect when AI systems behave abnormally and respond effectively to AI-specific incidents?

0/4 answered

MR-1How does your organisation monitor AI models in production for drift and degradation?

Think about whether anyone watches for changes in model accuracy, input distributions, or output patterns that could indicate a problem — natural or adversarial.

MR-2How does your organisation detect anomalous behaviour in AI system inputs and outputs?

Consider whether unusual patterns in what users send to AI systems or what those systems produce are detected and investigated, or whether they go unnoticed.

MR-3Does your organisation have incident response playbooks that cover AI-specific failure modes?

Think about whether your incident response plans address scenarios like a poisoned model in production, a prompt injection attack at scale, or a model data leak — or whether AI incidents would be handled ad hoc.

MR-4How quickly can your organisation roll back or disable a compromised AI model in production?

Consider whether you could take a model offline within minutes if it were found to be compromised, or whether the process would take hours or days and require manual intervention across multiple systems.

Self-assessment report

AI Security

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the AI Security maturity model

Artificial intelligence introduces attack surfaces that traditional cybersecurity was never designed to address. Training data can be poisoned to embed hidden behaviours, models can be stolen or reverse-engineered through repeated queries, prompt injection can override safety guardrails, and adversarial inputs can cause confident but dangerously wrong outputs. These are not theoretical risks — they are actively exploited in the wild, and they grow more consequential as organisations embed AI into critical decision-making.

Most organisations bolt AI into their operations long before they understand how to secure it. Security teams lack visibility into model behaviour, data science teams lack security training, and nobody owns the gap between them. This model exists to close that gap — not by repackaging generic security advice, but by asking specific, observable questions about how AI systems are threat-modelled, built, deployed, monitored, and governed throughout their lifecycle. The goal is to surface the real distance between how secure your AI systems appear to be and how secure they actually are.

The AI Security maturity model assesses six areas that together span the full lifecycle of securing AI and machine learning systems — from threat modelling and training data integrity through to runtime protection and incident response. It contains 24 questions across 6 dimensions, each describing three levels of maturity through concrete, observable behaviours. The assessment is designed for any organisation that develops, deploys, or consumes AI systems, regardless of whether those systems are built in-house or procured from third parties.

Who this assessment is for

  • CISOs and security leaders responsible for securing AI deployments across the organisation
  • ML engineers and data scientists who build and maintain AI/ML systems and pipelines
  • AI platform teams managing model registries, deployment infrastructure, and serving layers
  • Risk and compliance teams assessing AI-specific threats and regulatory obligations
  • Product owners and business leaders deploying AI into customer-facing or decision-critical processes
  • Third-party risk teams evaluating the security posture of AI vendors and embedded models

The three maturity levels

  • Level 1 — Unguarded: AI systems are deployed with little or no consideration of AI-specific security risks. There are no threat models for ML pipelines, no controls around training data integrity, and no monitoring for adversarial behaviour. Models are treated as opaque tools — nobody is responsible for their security, and vulnerabilities are discovered only through incidents or external disclosure.
  • Level 2 — Risk-Aware: AI-specific threats are identified and controls are applied to the highest-risk systems. Threat models exist for critical AI deployments, training data provenance is tracked, input validation and output filtering are in place, and there is a registry of models in production. Security and data science teams collaborate on defined processes, though coverage may be uneven across all AI systems.
  • Level 3 — Hardened: AI security is built into the full model lifecycle. Every model is threat-modelled and adversarially tested before release, training data and third-party models are verified before they are trusted, production behaviour is monitored for drift and attack, and incident playbooks for AI-specific failure modes are rehearsed. The organisation treats AI systems as first-class security assets with the same rigour applied to critical infrastructure.

The 6 areas assessed

1. AI Threat Modelling & Risk Assessment

Whether the organisation systematically identifies and evaluates threats specific to its AI systems. This area examines whether AI attack surfaces are mapped, whether threat models cover ML-specific risks such as data poisoning and model extraction, and whether risk assessments are updated as models and their operating environments change.

2. Training Data & Pipeline Security

How the organisation protects the integrity and provenance of data used to train and fine-tune models. This area covers data lineage tracking, poisoning detection, access controls on training pipelines, and whether the organisation can demonstrate that its training data has not been tampered with or contaminated.

3. Model Security & Integrity

Whether models themselves are protected from theft, tampering, and supply chain compromise. This area assesses model signing and versioning, adversarial robustness testing, protection of model weights and architectures, and how third-party or open-source models are vetted before deployment.

4. Inference & Runtime Security

How AI systems are protected while serving predictions or generating outputs in production. This area covers prompt injection defences, input validation, output filtering, rate limiting to prevent extraction attacks, and whether runtime behaviour is monitored for signs of adversarial manipulation.

5. AI Access Control & Governance

Whether the organisation controls who can deploy, modify, and interact with AI systems, and whether AI agents operate within defined permission boundaries. This area examines model deployment approval workflows, registry completeness, role-based access to model endpoints, and governance of autonomous AI agents.

6. AI Monitoring & Incident Response

Whether the organisation can detect when AI systems are behaving abnormally and respond effectively to AI-specific incidents. This area covers drift detection, anomaly monitoring on model inputs and outputs, AI-specific incident playbooks, and the ability to rapidly roll back or disable compromised models.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

  • OWASP Top 10 for LLM Applications — a catalogue of the most critical security risks specific to large language model deployments
  • MITRE ATLAS (Adversarial Threat Landscape for AI Systems) — a knowledge base of adversarial tactics and techniques targeting machine learning systems
  • NIST AI Risk Management Framework (AI RMF) — guidance for managing risks across the AI lifecycle, including security and resilience
  • Google Secure AI Framework (SAIF) — a conceptual framework for securing AI systems across development and deployment
  • ISO/IEC 27090 (in development) — forthcoming international guidance on addressing security threats and failures in AI systems

Frequently asked questions

What is the AI Security maturity model?

Assess how well your organisation secures AI systems across their full lifecycle. It is an original, simplified model with three maturity levels (Unguarded, Risk-Aware and Hardened), assessed through 24 questions across 6 areas: AI Threat Modelling & Risk Assessment, Training Data & Pipeline Security, Model Security & Integrity, Inference & Runtime Security, AI Access Control & Governance and AI Monitoring & Incident Response.

How long does the AI Security assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Unguarded), 2 (Risk-Aware) or 3 (Hardened). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.