Enterprise AI Security Assessment: A Practical Checklist

An AI security assessment answers five questions: what AI exists, who owns it, what it can reach, how it can be attacked, and what evidence shows it is under control. Use the checklist below to run one yourself, or to judge any assessment you are offered.

1. Discovery and inventory

• Is there a current list of AI applications, agents, tool servers, models and libraries in use?
• Does it come from evidence on endpoints, servers, cloud accounts and identity logs, not only from a survey?
• Are the blind spots written down, with the share of the estate each one represents?
• Does anything new appear automatically, and how long does that take?

2. Ownership and decisions

• Does every asset have a named owner?
• Is there an approved list, with conditions where relevant, and a record of who decided and when?
• Is there a review date, and what happens when it passes?

3. Identity and secrets

• Where do provider API keys live, and are any readable in files, shell profiles or repositories?
• Is the same key reused across machines or teams?
• What non-human identities do agents use, and what can each of them do in your cloud accounts?
• Who reviews those identities, and how often?

4. Agents and tool access

• Which tool servers (MCP) are connected, from which publishers, and at which pinned versions?
• What can each agent read, write or run? Is the scope the minimum it needs?
• Are tool descriptions reviewed, and do changes to them trigger a review? See Tool Poisoning and Malicious MCP Servers.
• Which agents run unattended, and who is accountable for them?

5. Data exposure

• Which AI assets can reach sensitive data, customer data or source code?
• Where does the data go: which providers, regions and retention terms?
• Is there a policy for what may be sent to an AI service, and is it enforced or only written down?

6. Attack surface and testing

• Have your agents been tested for prompt injection, including through content they retrieve?
• Have they been tested for secret disclosure, excessive agency, data exfiltration through tools, and unsafe handling of their own output?
• Is each test result a clear verdict with evidence, such as proven, not reproduced or could not test?
• Are tests run only against systems you are authorised to test?

7. Governance and regulation

• Is each system classified under the rules that apply to it, such as the EU AI Act tiers, by an accountable person?
• Is it clear whether you are the provider or the deployer of each system?
• Are controls mapped to the frameworks you report against, such as NIST AI RMF, ISO/IEC 42001 and the OWASP Top 10 for LLM applications?

8. Evidence and monitoring

• Is every decision, approval and exception recorded in a log that cannot be quietly changed?
• Can you produce signed or otherwise verifiable evidence for an auditor?
• Are alerts routed to the people who can act, through the tools they already use?

Questions to ask any assessor or vendor

• Is it read-only? What does it collect and what does it never touch? Does it read prompts, responses or file contents?
• Where does the data go? Where is it stored, who can see it, and how is it deleted?
• What is the status of its assurance? Ask for certifications held, not in progress, and for the date and scope of any independent penetration test.
• What can it not see? A credible answer names blind spots.
• What is available today? Ask for a list that separates released capabilities from planned ones.

Scoring the result

For each section, mark every line yes, partly or no, and note the evidence. Weight the gaps by what the assets can reach, not by how many gaps there are: one agent with production credentials outweighs ten harmless plug-ins. Fix the highest reach first, and repeat the assessment on a schedule.

Araghatta's free assessment covers up to 25 endpoints, is read-only, and returns a risk report and an AI Bill of Materials. See the assessment and whether it fits your environment.