Skip to main content
Data Products logo

Home/Assessments/Cyber Risk

Free · About six minutes · Instant result

Find out what your AI estate is actually exposed to.

Fifteen questions across model security, data protection, supply chain, access and detection, mapped to the NIST AI Risk Management Framework and ISO/IEC 27001. You get your score and a prioritized list of what to fix first, on this page, immediately. Scoring happens in your browser — nothing leaves it unless you ask for the report by email at the end.

15Questions
5Areas scored
~6 minTo complete
NoneEmail required

0 / 15 answered

This assessment needs JavaScript to score itself. The questions below are worth reading either way — they are the five things that decide whether an AI estate can be defended. If you would rather talk them through, book a strategy call, or see the Data Platform Accelerator, where we verify these against your systems rather than your answers.

Model security

The attack surface your existing review was not built for

0 of 3

Has anyone outside the build team tried to break your AI systems — prompt injection, jailbreaks, poisoned inputs — and was it repeated after the last model change?

Are the prompts, system instructions and retrieval sources behind your AI features treated as protected assets rather than application config?

If a model produced something harmful or disallowed, is there a control that stops it reaching the user, rather than an instruction asking it not to?

Data protection

What leaves your boundary, and what is kept

0 of 3

Could you produce a current list of exactly which fields leave your boundary on each AI call?

Is sensitive data masked, redacted or excluded before it reaches a model, rather than relied upon not to surface?

Do you have a defensible answer to where prompts and outputs are retained, for how long, and by whom?

Supply chain

The models and vendors you depend on

0 of 3

Do you have an inventory of every AI model, API and vendor in use, including ones a team adopted without procurement?

Have you read what your AI vendors may do with your inputs — training, retention, sub-processing — in the contract rather than the marketing page?

If a model provider changed behaviour or terms on thirty days’ notice, would you know which of your systems are affected?

Identity and access

What an AI system is permitted to do

0 of 3

Do AI systems act under their own identity with scoped permissions, rather than borrowing a person’s credentials or a shared key?

Is what an agent may do — read, write, send, transact — bounded by something enforced, rather than by the prompt?

Are the keys and credentials used by AI systems rotated and auditable like any other production secret?

Detection and response

Whether you would know, and what happens next

0 of 3

Would you know if an AI system began behaving differently from how it behaved at launch?

Is there logging that would let you reconstruct what an AI system was asked and what it did, after the fact?

Is there a named path for containing an AI-related incident, distinct from your general IT incident process?

Answer all three to continue.

Data Products · AI Security Posture Report

AI & Data Cyber Risk Screen

Prepared —
Reference —
Scored in your browser
0 of 30 —

Your result

0%Overall posture across the five areas
0Areas at or above the production threshold
0Areas flagged as a gap — 2 of 6 or below

Posture by area

Each bar is your score out of 6. The marker sits at 4, the level where a production build usually stops being rework. Hover or focus a row to see which of its three answers pulled it down.

What is holding up

    Where the risk sits

      What to fix first

      Ordered by where you scored lowest, with ties broken toward the more foundational layer. Fixing these in another order usually means doing the work twice.

      View the scores as a table
      Your score for each of the five posture areas, out of 6.
      DimensionScoreOfStanding
      Total036—
      Talk through your result Close the exposure

      Prefer to keep a copy? — it is a PDF, not a mailing list.

      The two-week version

      The version that is not self-reported.

      A screen tells you where you are exposed. It does not close the gap, and it rests on your own account of your systems — which is the first thing a security review will test. The Cyber Risk Sprint verifies these five areas against the systems themselves and closes what it finds, starting where you scored lowest.

      01 Posture audit

      The same five areas, verified against your actual systems, agents and vendor terms rather than your account of them.

      02 Gap register

      Where a build actually breaks, named specifically enough that someone can put a number against fixing it.

      03 Order-of-magnitude cost view

      What each path costs to stand up and to run, sized at your volumes — enough to know whether the number is five figures or seven.

      04 Prioritized next steps

      One sequence with the reasoning attached, so the order can be argued with rather than taken on faith.

      Two weeks, fixed fee. It is designed as a low-risk way in, and the output is yours to use whether or not you take the work further with us. When a decision needs more than that, there is a longer engagement above it.

      See the Cyber Risk Sprint
      Being straight about it

      What this is, and what it is not.

      It is a structured self-assessment

      Eighteen questions drawn from the reasons builds actually fail — thin data foundations, no review path, no evaluation harness, unmodeled cost, no adoption, unexamined exposure. Answering honestly is the whole method.

      It is not a diagnosis

      It scores what you tell it. It cannot see your architecture, read your contracts or interview your people, and it will not catch a problem you do not know you have.

      Nothing is collected unless you ask

      Scoring happens in your browser. Your individual answers are never transmitted. The one exception is deliberate: if you ask for the report by email at the end, your address and the six dimension scores are sent to us so we can send it. Skip that and nothing leaves your machine.