Security for AI: Readiness and Risk Playbook

The fast path to understanding your AI risk—and proving you're ready to ship.

Download the Playbook

This playbook is built from real-world work with leading AI builders and distills practices proven across thousands of hours of threat modeling, adversarial testing, and live-system remediation. It’s designed for security and product leaders who need a repeatable, evidence-driven way to prove readiness before shipping. 

  • Understand the four readiness levels—from baseline to continuous—and what “good” looks like at each stage.
  • Use a standardized AI risk score to communicate exposure, impact, and likelihood across teams.
  • Know when to use Pentest, AI Red Teaming, or Bug Bounty Programs to validate controls.
  • Apply concrete controls for Retrieval-Augmented Generation (RAG), Model Context Protocol (MCP) governance, agent and tool authentication, and CI/CD evaluation gates.
Download the Playbook

Frequently asked questions

Organizations adopting AI often ask the same questions: When should we add AI checks to a pentest? When does a system need its own assessment? And when is full adversarial simulation required? 
The answer depends on your AI risk maturity, deployment model, and business impact. This framework provides a clear path from essential safeguards to continuous, automated assurance—covering everything from simple LLM features to autonomous, multi-agent systems. At each level, it defines the risks, controls, and testing approaches you need, helping you determine your current state, plan your next release, and gather credible evidence for sign-off.

This playbook is for CISOs and product security leaders who own sign-off, AppSec and red-team teams responsible for testing, and platform or ML owners who manage guardrails and telemetry.

  • AI Security Readiness. A four-level path from initial coverage to continuous validation, with goals, controls, checks, and testing methods at each level.
  • AI Risk. A standard way to assess exposure, safety impact, security posture, and likelihood, then map the score to the level and testing strategy that fit the system.

Begin by mapping your AI inputs, outputs, and risk areas, then score each system with the risk model to determine its readiness level. From there, run the recommended tests and controls and integrate the results into your release process with documented evidence.

A defensible basis for sign-off, a prescriptive testing plan that scales with risk, and artifacts you can take to leadership and audit.