AI security self-audit

Free tool4 sections · 2 min readBy Dezső Mező.mdAI securityOWASP LLMChecklistFree

The checklist is free and there is no email gate: the result appears the moment the fifteenth question is answered. It runs entirely in the browser, so nothing is submitted anywhere unless you decide to get in touch afterwards.

01Five domains

The questions are grouped into data, model, prompt, access and response. Each domain is scored on its own as well as rolled into the overall number, because a system is usually strong on some axes and weak on others rather than uniformly good or bad.

02What it actually asks about

Data classification and PII masking before the model call. Hosting region and whether your contract excludes training. Version pinning against a moving `latest`. Injection testing against the OWASP LLM Top 10. Secrets in system prompts, server-side-only calls, per-user rate and token limits, per-user authorisation on retrieval, and validating responses on the way back out.

03What you get

A weighted score out of a hundred and one of four verdict bands, from critical to strong. Under that, a per-domain breakdown, and a list of next steps generated only for the questions you scored badly on, each labelled with the domain it belongs to.

04Where it stops

It is a self-assessment, so it covers roughly the first tenth of a real audit. It will not threat-model your system or build an eval harness against your own data. It will tell you which of the five axes to look at first, which is usually the question people actually have.

What to take away

Fifteen questions, five domains, about five minutes.
Runs entirely in your browser. No email gate, nothing submitted.
Scores each domain separately, because systems are rarely uniformly good.
Covers the first tenth of a real audit, and says which axis to start on.

We build this for clientsCybersecurity

Open the tool

More from the lab

Browse all entries

Want this looked at on your own system?Start a conversation