The baseline for Safe, Sane and Secure AI

Purpose:
This checklist is engineered to raise your awareness where you may not realise how exposed modern AI systems are. Each item includes non-technical explanations so anyone can understand the implications – and recognise gaps they didn’t know existed.

Maturity Scale (0–5)

Level	Description
0 – Unaware	No control, no awareness.
1 – Ad Hoc	Informal, inconsistent practices.
2 – Emerging	Some processes documented.
3 – Managed	Processes followed and maintained.
4 – Monitored	Reviewed, audited, and improved.
5 – Optimised	Automated, integrated, continuously tested.

Q1. Have you documented all human and automated actors, their roles, and the exact data/model access each one has?

Why this matters:
Most breaches are not directly caused by hackers – they’re caused by incorrect access over exposing. AI systems amplify this. If the wrong person or service can access model weights, logs, or training data, you effectively lose control of your system.
Common Failures:

Developers retain production access long after they need it
Service accounts have “full admin” permissions
AI pipelines share the same storage bucket for test and production
No accountability matrix
No record of data sources, access, change control
No AI data use policy
How to Test: Compare actual permissions with intended roles.
Maturity (0–5): _

Q2. Do you track every external dataset, API, pre-trained model, and tool you rely on – including licensing and security?

Why this matters:
80%+ of AI systems now depend on third-party models and data. If even one upstream source is poisoned, malicious, or unlicensed, your entire system – and your organisation – is at risk. This is the new supply-chain attack surface.
Common Failures:

Downloading checkpoints from public repositories without integrity checks
Using scraped datasets unknowingly containing private or illegal content
Pre-trained models with unknown training data lineage
No third-party audit checklist
No SME review of AI Outputs
How to Test: Inventory everything; check signatures and licences.
Maturity: _

Q3. Do you have a written, tested incident response plan for model drift, data poisoning, adversarial inputs, and AI-specific breaches?

Why this matters:
AI failures escalate fast. A poisoned dataset or drifted model can produce harmful or incorrect outputs within minutes. Without a plan, organisations freeze, argue, or react too slowly.
Common Failures:

No rollback plan to return to a safe model
No preplanned escellation path for failures
No threshold for “model is behaving strangely”
No pre-vetted public or investor relation statement
No process for detecting or stopping poisoned training runs
How to Test: Run a 1-hour tabletop simulation.
Maturity: _

Q4. Do you maintain an updated record of adversarial attacks (prompt injection, jailbreaks, poisoning) and red-team results?

Why this matters:
Attackers share jailbreaks daily. If you aren’t tracking them, you’re falling behind. Without active red-teaming, you only discover vulnerabilities when they’re exploited.
Common Failures:

Red-teaming performed once and forgotten (or not at all)
Teams unaware of prompt injection risks
No regular review of logs and activity
No audit checklist
CI/CD pipelines not testing identified issues prior to deployment
No follow-up to red-team findings
How to Test: Conduct regular red-team campaigns. Review audit results of activity and logs. Review sampling of model outputs.
Maturity: _

Q5. Are identity checks and background reviews performed on any person with access to sensitive training data or production models?

Why this matters:
Internal access misuse is among the most common causes of AI data leaks – especially when training data includes confidential or regulated information.
Common Failures:

Contractors given long-term production access
No offboarding audit
Shared logins or device reuse
No employee AI Use policy
How to Test: Review access logs vs personnel directory.
Maturity: _

Q6. Is someone explicitly accountable for AI/ML security or data governance?

Why this matters:
If no one owns AI security, it never happens. Especially in high-velocity environments, “everyone’s job” becomes “no one does it.”
Common Failures:

No owner of model risk
Security and ML teams assume the other has it covered
No list of roles and responsibilites
No written escalation pathway for anomalies
How to Test: Ask: “Who is the single person accountable?”
Maturity: _

Q7. Do you enforce MFA or hardware keys for any access to production inference, model stores, or sensitive data?

Why this matters:
If an attacker takes control of your deployment infrastructure, they control the entire AI system – including outputs to your users.
Common Failures:

SSH or similar keys stored on laptops
MFA enforced on accounts but not on service access
How to Test: Attempt to access production using a non-MFA path.
Maturity: _

Q8. Are model weights, encryption keys, and API secrets stored in systems requiring multi-party approval or split control?

Why this matters:
Model weights are the “crown jewels.” Losing them means losing your competitive advantage, your privacy posture, and potentially your entire product.
Common Failures:

One engineer can download all model weights
API keys stored in plain text
No keys rotation policy
No independent review of access controls
How to Test: Attempt single-person key retrieval.
Maturity: _

Q9. Are data schema, invariants, ranges, and model performance requirements checked on every code and data commit?

Why this matters:
AI breaks silently. Often the first sign something is wrong is output quality deteriorating – or becoming dangerously biased.
Common Failures:

Silent feature drift
Preprocessing changes not applied to old data
No automated CI/CD pipelines
No data use policy
How to Test: Enforce automated CI/CD data tests.
Maturity: _

Q10. Do you use automated tools to scan for code vulnerabilities, dependency exploits, model leakage, and bias patterns?

Why this matters:
You cannot manually detect subtle vulnerabilities in LLMs or ML pipelines. Automation is essential.
Common Failures:

Outdated dependencies
Unchecked model versions with leakage issues
No automated CI/CD pipelines
How to Test: Run SAST/SCA + model scanners weekly.
Maturity: _

Q11. Do you conduct external AI security audits and have a disclosure path for researchers to report issues?

Why this matters:
External eyes catch what internal teams miss. Lack of disclosure paths means you won’t hear about vulnerabilities until they are exploited.
Common Failures:

“Security by hope”
No audit covering prompt injection or model extraction
No automated CI/CD pipelines
No external red-team or verification testing
How to Test: Review last audit scope.
Maturity: _

Q12. Have you analysed ways your system can be misused (e.g., harmful, misleading, or biased outputs) and mitigated them?

Why this matters:
Many AI systems fail not because they are hacked, but because they embarrass or harm the organisation publicly.
Common Failures:

No testing for reputation risk
No guardrails on toxic or biased responses
No audit or validation checlist
No written and tested crisis plan
How to Test: Red-team for harmful content.
Maturity: _

Q13. Is all training data tracked, validated, and monitored against poisoning or unauthorised modifications?

Why this matters:
Data poisoning is one of the fastest-growing attack vectors. A tiny fraction of bad data can alter outputs significantly.
Common Failures:

Training sets overwritten or mixed unknowingly
No versioning
Public datasets treated as trusted
No audit or validation checlist
No SME review and monitoring of model outputs
How to Test: Apply hashing, lineage tracking, version control. SME model validation.
Maturity: _

Q14. Do you have real-time monitoring for drift, anomalies, and strange or out-of-pattern model behaviour?

Why this matters:
AI systems degrade over time. They react to new patterns, new inputs, new user behaviour – and eventually become unpredictable.
Common Failures:

Silent accuracy degradation
Undetected bias creep
No audit or validation checlist
No automated CI/CD pipelines
How to Test: Trigger synthetic anomalies and watch detection. SME model validation.
Maturity: _

Q15. Are incoming prompts and outgoing outputs sanitised to prevent jailbreaks, injection, exfiltration, or downstream system abuse?

Why this matters:
Prompt injection is the new SQL injection. If your model can be manipulated, your entire workflow can be hijacked causing financial and reputational damage.
Common Failures:

Outputs containing sensitive internal system prompts
Apps passing model outputs directly to tools/actions
No monitoring or regular review of activity and logs
How to Test: Run known jailbreak patterns.
Maturity: _

Q16. Do you employ privacy-preserving techniques or data masking where needed?

Why this matters:
If your training data contains identifiable or sensitive information, the model can inadvertently leak it.
Common Failures:

Training on production data with PII
No masking or tokenisation of data
No monitoring or regular review of activity and logs
No automated PII identification
No data policy
How to Test: Run known tests to expose PII.
Maturity: _

Q17. Do you enforce rate limits, cost controls, and monitoring to prevent inference overuse or economic denial-of-service?

Why this matters:
Attackers can bankrupt you by forcing your model to work overtime. LLMs are expensive to run; uncontrolled usage is a financial risk.
Common Failures:

No rate limits
Apps that let users call the model in uncontrolled loops
No monitoring or regular review of activity and logs
How to Test: Simulate high-volume abuse.
Maturity: _

Next-Step Recommendation

After completing this checklist, organisations typically discover:

30–70% of their AI estate is overexposed
No one is responsible for AI security
Model behaviour is unmonitored
Access boundaries are unclear
External models/data are unverified
No poisoning or drift protection exists
They are one prompt injection away from a public incident

Book a call to discuss how we can help, or get the immediate start with our Policy, Risk and Compliance Quick Start – the SECURE-AI Governance Playbook coving all aspects of AI risk, governance and control.

AI Security Baseline Awareness Checklist