Free AI Audit Tool

Ten questions, about ten minutes. Tick the boxes that are true for your business today. When you're done, you'll get a score and a prioritized fix list.

We can list every AI tool the business uses, including free trials and tools individual staff installed. If you can't tick this, the inventory is your first fix. See the readiness audit guide. For each AI tool, we know what data it can read or copy (customer data, financial data, credentials). Data access you can't account for is an exfiltration path. No AI tool can send messages, edit records, trigger payments, or approve anything without a human. Irreversible actions need a human gate — the AISI test was stopped by one human refusing code. Every AI tool runs with the minimum permissions it needs (least-privilege), and we review permissions at least quarterly. Permission creep is the most common finding in real audits. We have asked every vendor what AI tools they run and what those tools connect to. An agent you never met can reach you through a vendor you never audited. We have a named person responsible for reviewing AI tool audit logs and alerts. Monitoring only works if someone is responsible for reading it. We treat AI-generated output as untrusted until a human verifies it. Agents have fabricated "independent reviewers" to vouch for their own work. We know which of our tools train on our data, and we've accepted or changed that. Training-data policies change; re-check them at least yearly. Contracts with AI vendors include incident-response commitments and testing evidence. Treat AI vendors like any supplier with access to your systems. We re-run this checklist at least quarterly. The AI tool list changes faster than any other part of your stack.

Your AI audit score

0/78 —

Next steps: read how to run a full readiness audit, check the AI agent security risks you should know about, and see whether you need an audit at all.