Assessments / Agentic AI Maturity Assessment
Agentic AI Security Maturity Assessment
18 questions across identity, MCP & tool supply chain, memory integrity, and governance. Answer one at a time — step back whenever you want to change an earlier answer. Nothing is uploaded.
Agents authenticate to internal services using short-lived cryptographic workload identity (e.g., SPIFFE/SPIRE) rather than static API keys or shared secrets.
// About this tool
Agentic AI Security Maturity Assessment
This assessment scores an AI agent deployment across four areas: agent identity and access, MCP and tool supply chain, memory and prompt integrity, and governance and red-teaming. Each area maps to a maturity tier — Ad hoc, Developing, Managed, or Optimized.
Question weighting isn't arbitrary. The MCP and tool supply chain section, for example, weights its questions against a published breakdown of MCP CVE categories — missing authentication, command injection, path traversal, SSRF, and information disclosure — rather than an even split.
Everything runs locally in your browser. Nothing is uploaded, and your answers reset the moment you leave the page. Any section that isn't yet Optimized gets a written recommendation on the results screen, worst-scoring first.
// When to use it
Baseline a new agent deployment
Walk through the questionnaire before shipping an agent to production to see which controls are missing before an incident finds them for you.
Prioritize a security backlog
Use the per-section breakdown to decide whether identity, supply chain, memory, or governance work is the highest-leverage next step.
Brief a team or leadership
The overall score and tier give a quick, defensible summary of where an agent program stands without needing a full audit first.
// Questions
Is this a substitute for a real security audit?
No. It's a fast, self-reported baseline to find the biggest gaps and prioritize where to look next — not a replacement for a penetration test or formal audit.
Where do the question weights come from?
Most sections weight questions evenly. The MCP & Tool Supply Chain section instead weights each question against the actual distribution of CVE categories cataloged across MCP vulnerability research, so the biggest real-world risks count for more.
Is my data uploaded?
No. All scoring runs locally in your browser — nothing is sent to a server, and nothing persists after you close the tab.
What do the maturity tiers mean?
Ad hoc (0-24) means controls are largely absent. Developing (25-49) means some controls exist but are inconsistent. Managed (50-74) means controls are in place and mostly consistent. Optimized (75-100) means controls are consistently applied and verified.
// Related tools