Why does the number of questions change when I change what AI output does here?

Because some controls have no surface to exist on. Where nothing built with AI runs on its own, there is no shipped thing to have left a key in and no route to have failed to authorize, so those controls carry a weight of zero for that shape and drop out of the divisor entirely. A dropped control is not a silent failure and it is not a free pass: the remaining controls are weighted heavier, so what leaves through the tools and what stands behind a request carry more of the score.

Why is one absence enough to override a score of 95?

Because a weighted average cannot price an absence. It averages it away against everything you do have, which is exactly the arithmetic that lets an organization feel prepared and not be. Three products RedHub already ships gate on a specific absence instead of weighting it, and this assessment took all three instead of inventing a rule of its own. They are not three instruments converging: they share a scoring template, so this is a house position rather than independent agreement, which is worth knowing before it is used as evidence of anything.

Why does a mark of one release the gate when a zero does not?

Because thin and absent are different things, and only one of them can be improved from where it is. A one means somebody believes the terms are fine, or a callback happens when something feels wrong, or a restore was done once a long time ago. Each is a real if unreliable thing that exists and can be made reliable. A zero is nothing at all, and there is no version of nothing that a good score elsewhere compensates for.

Where do the bands come from?

From three products RedHub already ships in this niche, which all put their top band at 75 and their floor at 50: the recovery drill, the vendor posture kit and the pre-launch security gate. They share a scoring template, so that is a house position rather than three instruments agreeing, and choosing different thresholds by feel would still have made a free assessment disagree with three paid ones at once. The words are the safe-use drills ladder, which reads the weakest of six drills and starts DRILLED at 80; here it bands a weighted score and starts at 75.

How is this different from the AI governance gap assessment?

That one asks whether you can account for the AI in use: is there a list, a rule, a named human. This never asks whether there is a list. It asks what the things on it can do to you. The two disagree in both directions, which is the test of whether they are two instruments and not one twice: a complete and current inventory of tools that all train on your customer data reads well there and badly here, and an organization with no list can still refuse every request that arrives without a callback.

Can I check the score by hand?

Yes, and that is why every weight is on this page. Multiply each mark by its weight, divide by three, sum them, divide by the weight in scope, multiply by a hundred and round to the nearest whole number. The result is deterministic: the same answers always produce the same score, the same band and the same first thing to fix.

How this assessment works

The assessment marks up to 24 controls from 0 to 3 on what is true here today, weights them for what AI output does in this organization, and renormalizes over what is in scope. The result is a score out of 100 and one of three verdicts. Two gates can hold a verdict down regardless of the score, and neither can lift one.

It is deterministic. The same answers always produce the same score, the same band and the same first thing to fix. There is no model in the scoring path, which is why the whole method fits on one page.

The arithmetic

Each control carries a weight for each of the three shapes, and the weights for a shape sum to exactly 100. You mark every in-scope control from 0 to 3 for what is true here today. The score is the weighted marks divided by the weight in scope, as a percentage, rounded to a whole number.

earned  = sum(mark / 3 * weight)   over in-scope controls
inScope = sum(weight)              over in-scope controls
score   = round(earned / inScope * 100)

Marking a control not applicable removes its weight from the divisor instead of scoring it zero, so declaring something out of scope never costs you points. Controls your shape has no surface for were never in the divisor at all: where nothing built with AI runs, you are not graded on whether a shipped thing left a key in it.

Three controls are the exception and cannot be marked not applicable. They are the three the first gate reads, the gate treats a waived input as an absent one, and offering the box would be offering a door the scoring does not open.

Three bands

75 and above is DRILLED. 50 to 74 is UNEVEN. Below 50 is RAW, which is also where the first gate sends a result regardless of what it scored.

The floors are borrowed, and this lane has the strongest provenance of the six: three products RedHub already ships in this niche put their top band at 75 and their floor at 50. The Ransomware & AI-Outage Recovery Readiness Drill reads RESILIENT, GAPS, WOULD NOT RECOVER. The AI Vendor Security Posture Scrutiny Kit reads SOLID, PRESS FOR PROOF, RED FLAG. The Vibe-Coded App Pre-Launch Security Gate reads LAUNCH-READY, HARDEN FIRST, DO NOT SHIP. Three instruments landing on the same two numbers is a house position, not a coincidence, and picking different ones by feel would have put a free assessment in disagreement with all three at once.

DRILLED, UNEVEN and RAW are the AI Security & Safe-Use Drills ladder, and there are two adaptations, both worth stating. There it reads the weakest of six drills, and here it bands a weighted score. And there DRILLED starts at 80 rather than 75, because a worst-of-six is a harder test than a weighted mean and the same word needs a different floor behind it. UNEVEN is the word that earns the transplant, because the organizational failure is rarely that a company is uniformly bad. It is that one team is fine and another has never been asked, and no other ladder in this catalog has a word for that.

Two gates, and why they only ever hurt

A gate can lower a verdict and can never raise one. That is the whole mechanic, and it is the reason a verdict here means something a weighted average does not.

A fatal absence. Three absences each force RAW at any score. Nothing in writing about your data being trained on. A restore or fallback nobody has run. And -- as a pair, because that is how its source reads it -- neither an out-of-band callback nor a second approver standing behind a request that moves money or grants access.

None of the three is a judgment this assessment made. Each is a shipped product's own disqualifier, lifted unchanged to the organization that owns it: the vendor kit forces its worst verdict when a written won't-train commitment is absent, the recovery drill when either a tested restore or an AI fallback reads zero, and the payment gate when neither a callback nor a second approver is fully in place. That last one is a pair in its source, and an earlier draft of this page lifted half of it and called the half a disqualifier. It was not, and it was stricter than the product it claimed to be quoting.

Zero rather than one, and the difference is the whole reason the gate is usable. A one is thin and real: somebody believes the terms are fine, a callback happens when something feels wrong, a restore was done once years ago. A zero is the absence. Answer every one of them at one and the same organization can still reach the top band, which is deliberate: a weighted score can price a thin control, and it cannot price a missing one.

This is a disjunction, and the other lanes in this portfolio use conjunctions, so the difference is worth naming and not leaving as a quirk. A gate fires here when ANY ONE of three things is absent, because each of the three is independently sufficient to undo everything else. The model-layer property's kill chain fires only when EVERY link is weak, because defenses in series fail at the last one. Reaching for the same operator each time would have been a habit, not a reading of what these products do.

A control reading zero. A top verdict cannot sit on an in-scope control with nothing behind it, and is held at UNEVEN instead. Without this a weighted average quietly fills the hole in: twenty strong controls carry the number while the one you have not started disappears into the mean.

Three worked results

An organization at the narrowest shape, answering every control at 3 except the written commitment about training, which reads zero, scores 95 and returns RAW. Everything else about it is exemplary. One absence decides it.

The same organization with every one of the gate's four inputs at 1 instead of 3 -- somebody believes the terms are fine, a callback happens when something feels wrong, a second approver signs as a formality, a restore was done once a long time ago -- scores 87 and returns DRILLED. That is a lower score and a better verdict, and the pair is the whole instrument: 95 with an absence is worse than 87 with four thin things, because thin can be improved and absent cannot be priced.

An organization answering 2 across the board, at the same shape, scores 67 and returns UNEVEN with no gate fired. Nothing is missing and nothing is finished, which is where most organizations honestly are.

Every control and its weight

24 controls across eight domains in three groups: what you brought in, what is aimed at you, and what anybody has practiced. A weight of zero means the shape has no surface for that control and it is not scored. The three marked fatal are the ones the first gate reads.

Control	Read	Act	Build
Is there a clause you could produce today saying what you put into these tools is not used to train, and has somebody read it?Brought in · Who you bought from · fatal if absent	5	5	4
If you stopped using one of these tools tomorrow, is there a written path to getting your data out and having their copy deleted?Brought in · Who you bought from	5	4	4
Does the contract require the vendor to tell you if they had a breach, and does anybody here know where that notice would arrive?Brought in · Who you bought from	4	4	4
Do you know what these tools were granted access to when somebody connected them: mail, files, calendars, chat, code?Brought in · What you granted it	6	6	5
Can people here connect an AI tool to a company system on their own, without anybody approving it?Brought in · What you granted it	5	4	4
Does anybody go back and look at the grants that were made, and remove the ones nobody uses any more?Brought in · What you granted it	4	4	4
Do you know what people actually paste into these tools: customer records, contracts, source code, credentials?Brought in · What leaves through it	8	7	6
When the work genuinely needs something sensitive, is there a sanctioned way to do it, or is the answer just no?Brought in · What leaves through it	7	6	5
Do people here have a company account for the tools they need, or is a personal one the only way to do the work?Brought in · What leaves through it	5	4	4
Could somebody produce a convincing voice or video of a named person here, and does anybody act on either?Aimed at you · Being convincingly faked	5	5	4
Would a message written in a colleague's style, referencing real current work, be treated as genuine?Aimed at you · Being convincingly faked	5	5	4
If somebody here suspected they were being manipulated, is there somewhere to say so that costs them nothing?Aimed at you · Being convincingly faked	3	3	3
Before money moves or access is granted on a request, is it confirmed through a channel other than the one it arrived on?Aimed at you · What stands behind a request	6	6	5
Does anything consequential require a second person, and is that person able to refuse?Aimed at you · What stands behind a request	5	5	5
Is there a rule that seniority and urgency do not waive the check, and would it survive an angry executive?Aimed at you · What stands behind a request	4	4	3
Has anybody here practiced what to do with a request or a document that looks legitimate and is not?Practiced · What anybody has practiced	5	5	4
If it has been practiced, did it reach the people most likely to be targeted, or the people easiest to schedule?Practiced · What anybody has practiced	4	4	4
Does somebody joining here learn any of this before they are given access to anything?Practiced · What anybody has practiced	3	3	3
Is there anything here that would stop working properly if one AI vendor were unavailable for a week?Practiced · When it stops	4	4	4
Have both a restore and an AI fallback actually been run, rather than believed to exist?Practiced · When it stops · fatal if absent	4	3	3
If something went wrong at seven on a Friday evening, would somebody know it was theirs to handle?Practiced · When it stops	3	3	3
In anything built here with AI help, are the keys and credentials out of the code and out of the browser?Practiced · What you shipped with it	n/a	3	6
Does anything built here check on the server who is asking, rather than hiding what the user should not see?Practiced · What you shipped with it	n/a	3	5
Has anybody who did not write it read what was shipped?Practiced · What you shipped with it	n/a	n/a	4

The three shapes

Read. AI here drafts, summarizes and researches. A person reads and edits everything before it goes anywhere, and nothing built with it runs on its own. Pick this when the output is always somebody's draft. It is the narrowest shape and the most common one, and it is not the safe one: the tools still hold what was pasted into them.

Act. AI output goes out under your name, drives decisions, or is wired into automations that run without somebody watching each one. Pick this when something written or decided by AI reaches a customer, a supplier or a system without a person reading it that time.

Build. People here build and ship things with AI: scripts, internal apps, automations, sometimes customer-facing software, and sometimes by people who are not engineers. Pick this when something running in production was written mostly by a model, whoever pressed the button.

What this assessment cannot do

It cannot verify a single answer. Nothing here scans a network, reads a configuration, fetches a URL you supply or connects to anything, and that is a permanent design decision, not a missing feature. A tool in this category that accepts a hostname and reaches out to it server-side is a request-forwarding proxy with a marketing page attached, whatever it is called. Every number this returns is arithmetic on what you told it.

It measures what you have arranged and practiced, not whether it would hold against somebody actually trying. Those are different questions. The first is a fact about your arrangements and is knowable by asking; the second is established by somebody attempting it, which is a penetration test or a red-team engagement and is not what this is.

It is not an audit, it certifies nothing, and it says nothing about likelihood. Everything here is about what is in place, not about the chance that anybody comes for you. And it deliberately puts no figure on how common AI-assisted impersonation is: the numbers in circulation come mostly from vendors selling detection, they are not comparable with each other, and the controls here are worth having at any incidence above zero.

It also asks nothing about whether a model can be made to misbehave, or what an agent can reach and undo. Those are two different assessments with different controls. What we sell against these gaps is listed in full, including the two domains nothing on the shelf closes.

Common questions

Why does the number of questions change when I change what AI output does here?: Because some controls have no surface to exist on. Where nothing built with AI runs on its own, there is no shipped thing to have left a key in and no route to have failed to authorize, so those controls carry a weight of zero for that shape and drop out of the divisor entirely. A dropped control is not a silent failure and it is not a free pass: the remaining controls are weighted heavier, so what leaves through the tools and what stands behind a request carry more of the score.
Why is one absence enough to override a score of 95?: Because a weighted average cannot price an absence. It averages it away against everything you do have, which is exactly the arithmetic that lets an organization feel prepared and not be. Three products RedHub already ships gate on a specific absence instead of weighting it, and this assessment took all three instead of inventing a rule of its own. They are not three instruments converging: they share a scoring template, so this is a house position rather than independent agreement, which is worth knowing before it is used as evidence of anything.
Why does a mark of one release the gate when a zero does not?: Because thin and absent are different things, and only one of them can be improved from where it is. A one means somebody believes the terms are fine, or a callback happens when something feels wrong, or a restore was done once a long time ago. Each is a real if unreliable thing that exists and can be made reliable. A zero is nothing at all, and there is no version of nothing that a good score elsewhere compensates for.
Where do the bands come from?: From three products RedHub already ships in this niche, which all put their top band at 75 and their floor at 50: the recovery drill, the vendor posture kit and the pre-launch security gate. They share a scoring template, so that is a house position rather than three instruments agreeing, and choosing different thresholds by feel would still have made a free assessment disagree with three paid ones at once. The words are the safe-use drills ladder, which reads the weakest of six drills and starts DRILLED at 80; here it bands a weighted score and starts at 75.
How is this different from the AI governance gap assessment?: That one asks whether you can account for the AI in use: is there a list, a rule, a named human. This never asks whether there is a list. It asks what the things on it can do to you. The two disagree in both directions, which is the test of whether they are two instruments and not one twice: a complete and current inventory of tools that all train on your customer data reads well there and badly here, and an organization with no list can still refuse every request that arrives without a callback.
Can I check the score by hand?: Yes, and that is why every weight is on this page. Multiply each mark by its weight, divide by three, sum them, divide by the weight in scope, multiply by a hundred and round to the nearest whole number. The result is deterministic: the same answers always produce the same score, the same band and the same first thing to fix.

In one line

Score 75 or above with none of the fatal absences present and nothing else reading zero, and the verdict is DRILLED. Lose the training clause outright, or the tested restore, or both halves of the payment check at once, and it is RAW whatever the score says.

Run the assessment What we sell against these gaps