A 23-question framework for assessing AI security readiness, sharing it for feedback.

We build AI agent security tooling, and we put this checklist together. Sharing it because we think the questions are useful on their own, not as a lead-in to a pitch, and we'd genuinely like feedback on what's missing.

The problem we kept running into with security leaders: most orgs have opinions about AI governance but can't back them with evidence. "Do we have a policy" gets a confident yes. "How many AI systems are actually in production, and who controls them" gets silence.

So we built a self-assessment across four areas, 23 questions total, answered honestly (only tick what you can back with evidence, not what you intend to do eventually).

Visibility: full inventory of AI systems including vendor-embedded ones, what data and actions each system has access to, visibility into shadow AI usage.

Risk assessment: tested against things like multi-turn manipulation and tool abuse, not just single-message prompt injection, ongoing monitoring of AI behavior in production beyond uptime, an AI-specific incident response plan.

Governance: AI covered in existing compliance programs (SOC 2, ISO 42001, EU AI Act, etc.), clear ownership, testing that keeps pace with how often the systems actually change.

Board readiness: a quantified posture score you could hand the board today, versus a narrative.

Link if you want to run it yourself: https://www.humanbound.ai/ai-readiness