Free AI Security Scorecard

⏱ Takes about 4 minutes

This scorecard assesses your organisation's AI agent security and orchestration maturity across four critical areas. Answer honestly — the result is only useful if it reflects reality. No technical knowledge required.

At the end, you'll receive an instant risk rating and a recommended next step tailored to your score.

Deployment Security

Question 1 of 12

How are your AI agents' API keys, passwords, and credentials stored?

Hardcoded directly into config files or scripts, or stored in plain text documents

Stored in environment variables on the server — not encrypted

In a basic password manager shared with the team

In a dedicated encrypted secrets vault with access controls

Question 2 of 12

Have your AI agent deployments been tested for prompt injection vulnerabilities?

Prompt injection is when malicious content in the environment hijacks your agent's instructions.

We've never heard of prompt injection / not sure what this means

We're aware of it but haven't done any testing

We've done some informal checks ourselves

We have a formal security testing process that covers this

Question 3 of 12

Where do your AI agents source their tools, skills, or plugins from?

Publicly available community repositories without any vetting

Mix of sources — some vetted, some not

Only internally built or formally security-reviewed tools

We don't use external plugins / tools / skills

Question 4 of 12

Who in your organisation can access or modify your AI agent configurations?

Most or all of the team — it's broadly accessible

Only the person who originally set it up

A small group — informally agreed but no formal access controls

Defined roles with role-based access controls in place

Orchestration & Reliability

Question 5 of 12

How do your AI agents retain context between sessions?

Context = the knowledge, instructions, and history an agent needs to do its job reliably.

They don't — every session starts completely fresh

We manually paste context or instructions into each session

We have a documented knowledge base agents reference — not always consistently

We have a persistent memory system integrated into the agent environment

Question 6 of 12

What happens when an AI agent task fails or produces an error mid-execution?

We usually find out when something has already gone wrong downstream

The agent stops and someone manually restarts it when they notice

Basic alerting exists but recovery is still manual

We have automated error handling, logging, and recovery processes

Question 7 of 12

How many AI tools, agents, or automations are running across your business right now?

5 or more — from different vendors with no central oversight or coordination

3–4 tools with some informal coordination between them

1–2 tools with a clear owner for each

None deployed yet — we are evaluating

Governance & Compliance

Question 8 of 12

Does your organisation have a written policy governing how AI agents are used?

No written policy exists

Informal guidance only — nothing written or enforced

A policy is being drafted but not yet finalised

Yes — a formal, documented AI usage policy is in place and staff are aware of it

Question 9 of 12

Can your AI agents access, process, or output personal data about clients or employees?

Personal data includes names, emails, financial records, health info, or any data that could identify an individual.

Yes — and we haven't implemented specific controls around this

Yes — with some informal controls but nothing formally GDPR-reviewed

Yes — with full GDPR-compliant controls and a data processing agreement

No — agents are intentionally isolated from personal data

Question 10 of 12

Has your AI deployment been through any formal security or compliance review?

No review of any kind

We plan to do one but haven't yet

Yes — an informal internal review

Yes — a formal external security audit with written findings

Business Impact & Readiness

Question 11 of 12

How much time does your team spend per week managing, fixing, or supervising AI agent issues?

5+ hours — it's a meaningful drain on productivity

2–4 hours — it's noticeable and frustrating

Less than 1 hour — mostly runs smoothly

Not applicable — we don't have agents running yet

Question 12 of 12

How confident are you that an AI-related security incident wouldn't damage your client relationships or regulatory standing?

Not confident at all — it keeps me up at night

Somewhat concerned — I know gaps exist but haven't addressed them

Fairly confident — we've taken some steps

Very confident — we have documented controls and have tested them

Please answer all 12 questions to receive your score.

Your results are ready