Security assessment
Baseline self assessment
Score yourself against the security program baseline to rate your program. There are two versions, an abbreviated 5 minute version for boards and executives, and a longer form version.
No data is uploaded, all responses stay on this page.
Nothing is submitted, stored or sent anywhere. Scoring happens in your browser, and closing the tab erases it. A gap between the two versions, where the board says yes and IT says partial, is itself a finding. See the full security program baseline.
Board and executives
12 questions
Each question asks whether your team could show you the answer, not whether the control exists somewhere. Don't know scores the same as no.
-
1. Can you name the one person accountable for security, and what they would spend the next dollar on?
-
2. Could your team list the top three open risks, and who accepted each one?
-
3. Could they show everything you expose to the internet, with an owner on each line?
-
4. Do they know what share of accounts use hardware keys or passkeys?
-
5. Could they revoke a leaked API key within an hour?
-
6. Is EDR coverage reported against the full device list, not as a number of installs?
-
7. Is the deadline to patch a critical flaw measured in days, and is it met?
-
8. If a library you use were compromised today, would you know within a day where it runs?
-
9. Could they list every AI agent and integration, and what each can access?
-
10. Has someone outside tried to break in within the last 12 months, and do you know what they found?
-
11. If you were breached Friday night, do you know who you must notify, and by when?
-
12. Have you restored from backup in the last 6 months, and did it work?
IT and security
The full baseline
Every row of the baseline, with its tier. Each row is a question an auditor or board might ask. Mark anything that does not apply to your environment as not applicable and it will not factor into the scoring.
Do you build or deploy AI features or agents?
Security program
-
T1Security owner. A named person accountable for security, plus the security team roles and names.
The question your board should ask: Who owns security, and what would they spend the next dollar on?
-
T1Policy. A register of every policy with owner, published date and last reviewed date.
The question your board should ask: Which policy changed most recently, and what prompted it?
-
T2Risk register. Identified risks, each with an owner and a named person who accepted or mitigated it, reviewed on a cadence.
The question your board should ask: What are our top three open risks, and who accepted each one?
Inventoryeach item documented, with owner and review as necessary
-
T1External attack surface. Domains, subdomains, IPs, APIs, exposed services, forgotten assets.
The question your board should ask: Show me everything we expose to the internet, with an owner on each line.
-
T1Code. Every repo, and who can read/write.
-
T1Cloud. Accounts, projects, subscriptions, user access.
-
T1Endpoints. Laptops, servers, container hosts, mobile, contractor and BYOD.
-
T1Data. Where sensitive data lives, and the defined classification tiers that govern how each is handled.
-
T1SaaS and vendors. Inventory assets and user/admin access.
-
T1AI. Models, agents, MCP servers, and the credentials each holds.
-
T2Vendor risk. Security terms in the contract, a review before onboarding, access removed at offboarding.
-
T2Data retention and disposal. How long each data class is kept and how it is destroyed, including devices and media.
Identity, credentials and keys
-
T1Phishing-resistant MFA. Define what is allowed (FIDO2, passkeys, hardware keys) and what is explicitly not allowed (SMS, TOTP).
The question your board should ask: What share of our accounts use hardware keys or passkeys?
-
T1Least privilege on human and service accounts. Inventory and statement of least privilege.
-
T1Separate admin accounts from daily-use accounts, and a break-glass procedure for when SSO is down.
-
T1API key inventory; include owner, expiration and rotation policy.
The question your board should ask: How many API keys do we have, and how fast can we revoke one?
-
T1Secrets policy and testing approach.
-
T1Revocation policy/approach.
-
T1Access review and offboarding. Joiner, mover and leaver, covering contractors and service accounts.
The question your board should ask: Show me the last access review, and when it was done.
Endpoints and corporate IT
-
T1EDR on laptops, servers and other hosts, plus DNS or web filtering on user devices to block malicious and lookalike sites.
The question your board should ask: Show me EDR coverage measured against the full endpoint list.
-
T1Patching. OS, browsers, extensions and third-party apps.
-
T1SSO auth requirements; is posture a condition for system access.
-
T1SPF, DKIM and DMARC at enforcement, plus inbound filtering.
-
T1Full-disk encryption on every endpoint, as a condition of access.
-
T1Physical. Office and server-room access, device theft, screen locks.
-
T2MDM on mobile, including the phone that holds the MFA factor.
Infrastructure and configuration
-
T1Authenticated vulnerability scanning, internal and external, on a schedule.
-
T1Patch SLAs by severity, priced in days rather than weeks.
The question your board should ask: What is our deadline to patch a critical flaw, in days, and do we meet it?
-
T1Admin interfaces off the public internet.
-
T1Encryption of data at rest and in transit, with the keys managed somewhere other than the data.
-
T2Continuous evaluation of cloud configuration, permissions, network exposure and secrets.
-
T2Segmentation and egress control, so one compromised workload cannot reach the data store or ship data out quietly.
Code and supply chain
-
T1SAST, software composition analysis, secrets detection and IaC scanning in CI. Full repository testing.
-
T1Dependency provenance and pinning.
-
T1Protected main branch, review required before merge, and pipeline configuration treated as privileged.
-
T2Model-assisted review as an addition. Multiple models.
-
T2An SBOM with a path from new CVE to affected deployed versions.
The question your board should ask: If a library we use were compromised today, how long until we know where it runs?
AI agent, chat, code tools
-
AIModel and application behavior. Prompt injection, unsafe output handling, data disclosure, policy bypass, model vendor policy around data retention and training.
-
AITools and agents. Excessive agency, authorization boundaries, cross-user access, privilege escalation through connected tools.
-
AIMCP and integrations. Tool inventory, authentication and authorization policy.
-
AIRuntime. Sandboxing, high-impact tool calls monitored or human-looped, an audit trail.
The question your board should ask: Show me every AI agent and integration, and what each can access.
Adversarial validation
-
T1Defined process/tickets for identified vulnerabilities.
The question your board should ask: How old is our oldest open critical finding?
-
T2Keep periodic human-led testing.
The question your board should ask: When did someone outside last try to break in, and what did they find?
-
T3Continuous external attack surface discovery and automated adversarial testing using multiple models and exploitability validation.
Detection, response and recovery
-
T1Cloud provider audit logs enabled on every account, plus authentication events and admin actions, forwarded centrally.
-
T1IR plan, walked through once out loud.
The question your board should ask: When did we last run the incident plan, and what broke?
-
T1Notification obligations known in advance. Regulators, customers under contract, insurer, law enforcement, and the window for each.
The question your board should ask: If we were breached Friday night, who must we notify, and by when?
-
T1Backups process and testing.
The question your board should ask: When did we last restore from backup, and did it work?
-
T1Remediation SLA, testing, root cause, incident tracking.
-
T2Centralized security telemetry, monitoring, SIEM, with a defined log retention period.
-
T324/7 monitoring and alerting with a named owner outside business hours.
The human and brand surface
-
T1Phishing and security awareness training; is the program AI-aware.
The question your board should ask: What does an employee do when asked to move money or reset access?
-
T2Monitor lookalike domains, cloned login pages & social accounts, impersonation accounts and leaked credentials.
-
T2Pre-authorized takedown with a vendor holding power of attorney.
Results