The org layer
GenAI Security Assessment
What the AI already in use here exposes you to: what the vendors hold, what leaves through it, who can be convincingly faked, and what anybody has practiced.
A GenAI security assessment asks what the AI in use across a company exposes it to, rather than whether any one system is well built. It never asks whether you have a list of the tools: that is a governance question, and an organization can hold a complete, current, well-owned inventory of tools that all train on its customer data. This asks what the things on the list can do to you. It runs up to 24 questions across eight domains and returns a score out of 100 with one of three verdicts.
It is a self-assessment, and arranged is not tested. Nothing here scans, connects or attempts anything, so a good score says the arrangements you described are sound, not that anybody has tried them.
The domains sit in three groups, which is the honest shape of an organizational exposure. Some of it you brought in: what a vendor holds, what access somebody granted at a consent screen, what data leaves through tools nobody approved. Some of it is aimed at you: a convincing voice, a familiar writing style, an urgent request. And what decides whether either is survivable is usually whether anybody has practiced, which is not a property of any system.
Two gates can hold the verdict down whatever the score. Three absences each force the floor: nothing in writing about your data being trained on, a restore nobody has ever run, and -- as a pair, because that is how its source reads it -- neither a callback nor a second approver standing behind a request that moves money or grants access. None of the three is a judgment this site made. Each is a shipped RedHub product's own disqualifier, unchanged. A top verdict is also held back where any control reads zero, and neither gate can improve a verdict. The top band starts at 75, which is the floor three shipped products in this niche already agree on. The whole method is published, weights and bands included, so you can recompute the number by hand.
Nothing here scans, fetches or connects to anything, and nothing you type is stored by us: your answers ride inside your own result link. Opening or sharing that link sends the address, and so the answers, to our host the way any URL does, where it appears in ordinary server logs. Nothing in it names you or your company. It measures what you have arranged and practiced, not whether it would hold against somebody actually trying: it is a self-assessment, not a penetration test, not an audit and not a certification.
What does AI output do here?
This decides which questions have a surface to exist on, and it changes the weights more than it changes the length. Where nothing built with AI runs on its own, there is no shipped thing to have left a key in, so those questions are dropped instead of scored against you. Pick the widest thing that is true, not the thing that is usually true.
Results are subject to the Terms, which cover how a result may be described to somebody else. Nothing you answer is stored or sent to us.
Common questions
- What is a GenAI security assessment?
- It is an examination of what the AI in use across an organization exposes it to: what the vendors hold and what they were allowed to do with it, what access somebody granted by clicking through a consent screen, what data leaves through tools nobody approved, whether the people here could be convincingly impersonated, what stands behind a request that arrives, and what anybody has actually practiced. It is about the organization rather than about any one model or agent, and this one is self-declared and scored deterministically.
- How is this different from an AI governance gap assessment?
- That one asks whether you can account for the AI in use: is there a list, a rule, a named human. This one never asks whether there is a list. It asks what the things on it can do to you. The two come apart in both directions, which is the test of whether they are two instruments: an organization can hold a complete, current, well-owned inventory of tools that all train on its customer data, and it reads well there and badly here. Another can have no list at all and still refuse every request that arrives without a callback.
- How is this different from the other two security assessments?
- By layer. The model-layer assessment asks whether somebody can make a model misbehave, so its subject is the instruction path. The agent-layer one asks what an agent can reach and what happens when it acts wrongly. Neither has anything to say about the tool somebody in finance signed up for last Tuesday, which is this site's entire subject. Nothing here asks about prompts, connectors, stop controls or rollback.
- Why does one absence override the whole score?
- Because three products RedHub already ships each decided that a specific absence outranks their own weighted score, and this assessment took all three unchanged rather than inventing a rule. Nothing in writing about training. A restore nobody has ever run. And, as a pair because that is how its source gates, neither a callback nor a second approver standing behind a request that moves money or grants access. A weighted average cannot price an absence: it averages it away against everything you do have, which is exactly the arithmetic that lets an organization feel prepared and not be.
- We are small. Is any of this for us?
- Most of it, and the parts that are not are dropped rather than scored against you. Nothing on this page requires a security team. A written commitment about training is a clause somebody reads once; a callback rule is a sentence; a restore test is an afternoon. The one thing size genuinely changes is that a small organization has fewer people between a convincing request and a consequence, which usually makes the verification questions matter more rather than less.
- What happens to my answers?
- They are encoded into your result link and nothing is stored: no account, no database row, nothing tying a set of answers to a person or a company. Opening or sharing a result does send that address to our host the way any URL does, where it appears in ordinary server logs, and pasting it into a chat tool sends it to that tool's servers too. Nothing in it names you or your company. The link is the only copy: close the tab without keeping it and we cannot recover it.
The three shapes, briefly
Read. AI here drafts, summarizes and researches. A person reads and edits everything before it goes anywhere, and nothing built with it runs on its own.
Act. AI output goes out under your name, drives decisions, or is wired into automations that run without somebody watching each one.
Build. People here build and ship things with AI: scripts, internal apps, automations, sometimes customer-facing software, and sometimes by people who are not engineers.