A sample of the work
What an AI security finding looks like.
Illustrative example. Fictional data.
An assessment should help your team decide what to change and how to check it. This short excerpt shows the reporting format. No customer environment or live control was tested for this example.
The example scope
A pilot assistant reads a fictional internal policy library and prepares support-ticket updates. Staff review the draft before it changes a ticket.
- Included
- The assistant's access to the policy library, the ticket-update action and the approval record.
- Outside this excerpt
- Other agents, email delivery, production data and organization-wide compliance.
- Evidence handling
- Use synthetic records for the check. Agree the evidence location, permitted content and retention before a real assessment.
Example finding F-01
Enforce approval where the change happens.
Illustrative observation: The assistant asks for staff approval, but the system that updates tickets accepts an update without checking that approval.
Why it matters: A mistaken instruction or a direct request could change a ticket outside the agreed review process.
- Proposed correction
- Keep the pilot in draft-only mode until the ticket system verifies approval for the exact proposed change. Reject missing, expired or mismatched approval.
- Accountable roles
- The workflow owner approves the operating rule. The ticket-system owner implements enforcement. An agreed reviewer checks the evidence.
- Decision
- Agree the action boundary and acceptance checks before enabling write access.
How acceptance would be checked
- An update without approval is rejected, and the ticket remains unchanged.
- A valid approval permits only the reviewed change.
- Editing the draft after approval requires a new approval.
- Revoking the assistant's access prevents further updates. A named operator verifies containment.
Verification status: These checks are proposed, not executed. A real report records the agreed environment, test date, observed result and evidence reference for each check, including failures and coverage limits.
Start with one workflow.
Your assessment scope determines the systems reviewed and the evidence collected. Implementation is a separately agreed engagement.
Discuss an AI security assessment