Is this a penetration test?

No. A penetration test is somebody attempting to break a running system with permission to do so, and it produces findings about that system on that day. This is a structured set of questions about arrangements, answered by you, and it touches nothing.

Do we need one if we only use ChatGPT?

The number of tools is not what decides it. One tool connected to a mailbox, on a tier whose terms permit training, used by people pasting customer records into it, is a larger exposure than ten tools nobody connected to anything. What matters is what each one was granted and what goes into it.

Who should answer the questions?

Somebody who can see practice rather than policy, which usually means whoever fields the questions about the tools rather than whoever wrote the rule. Several questions here have a true answer that is one mark below the official one, and the person who knows the difference is rarely the person who owns the document.

What is a GenAI security assessment?

A GenAI security assessment examines what the AI in use across an organization exposes it to, rather than whether any single system is well built. It covers what the vendors hold and what their terms permit, what access was granted when somebody connected a tool, what data leaves through tools nobody approved, whether the people here can be convincingly impersonated, what stands behind a request that arrives, and what anybody has actually rehearsed. It is an organizational question, and it is separate from both model security and agent security.

Why the organization is the unit

Most AI security writing is about a system: this model, this agent, this application. That is the right unit when you built the thing. It is the wrong unit for the ordinary case, which is a company using thirty tools it did not build, half of which arrived without a decision.

At the organizational level the exposure has three sources and only one of them is a system you could audit. Some of it you invited: a vendor holds your data on terms somebody agreed to by clicking. Some of it is pointed at you: a convincing message, a familiar voice, an urgent request. And the difference between either of those being survivable or not is usually whether anybody has practiced, which is not a property of any system at all.

This is also why an organizational assessment cannot be run by scanning something. There is nothing to scan. The questions are about arrangements, terms and habits.

What it does not cover

It does not ask whether a model can be made to misbehave. Prompt injection, jailbreaking, output filtering and what a model remembers are a different assessment with different controls, and they are about the instruction path rather than about your company.

It does not ask what an agent can reach or what happens when it acts wrongly. That is a third assessment again, about permissions, stopping and reversal.

And it does not ask whether you have an inventory, a policy or a named owner. Those are governance questions: can you account for the AI in use. This asks what it exposes you to, which is a different question with different answers. An organization can hold a complete and current list of tools that all train on its customer data.

Where organizations are usually worst

Access granted at a consent screen. Connecting a tool to a mailbox is a bigger decision than adopting the tool, and it is made by clicking Continue on a permissions list written by the vendor to cover everything they might ever want. Almost nobody goes back and reads what was granted, and almost nobody removes a grant when the trial ends.

What actually gets pasted in. What a tool holds about a company is not what the company decided to give it. It is what everybody typed while trying to finish something, and the most sensitive version of a document is the one that produces the best answer.

And the thing nobody has practiced. Reading about a technique produces recognition of that technique; practicing produces the pause, and the pause is what generalizes to the version you have not read about.

Common questions

Is this a penetration test?: No. A penetration test is somebody attempting to break a running system with permission to do so, and it produces findings about that system on that day. This is a structured set of questions about arrangements, answered by you, and it touches nothing.
Do we need one if we only use ChatGPT?: The number of tools is not what decides it. One tool connected to a mailbox, on a tier whose terms permit training, used by people pasting customer records into it, is a larger exposure than ten tools nobody connected to anything. What matters is what each one was granted and what goes into it.
Who should answer the questions?: Somebody who can see practice rather than policy, which usually means whoever fields the questions about the tools rather than whoever wrote the rule. Several questions here have a true answer that is one mark below the official one, and the person who knows the difference is rarely the person who owns the document.

Find out where you stand

The assessment on this site asks up to 24 questions about what the AI in use here exposes you to, and returns a score, a verdict and, where a control is short, the one thing to fix first. It never asks whether you have a list of the tools. It takes about ten minutes, and questions your organization has no surface for are dropped rather than scored against you.

It is a self-assessment of what has been arranged and practiced, not of whether it would hold against somebody actually trying. Not a penetration test, not an audit, not a certification.

Run the assessment