Skip to content

AI Security Study: Closing the Gap in Enterprise AI Security

Read Now
AI SECURITY PROGRAM ASSESSMENT

See Where Your AI Security Program Actually Stands

AI adoption moved faster than most governance models could track. This assessment benchmarks your AI security practices against peer data, activity by activity, so you know exactly where to invest next.

Get Your AI Assessment
image (5)
GOVERNANCE VS. ENGINEERING

The Board Approved AI. The Controls Are Still Catching Up.

Most security teams can point to an AI policy, an approval workflow, and a governance board. Fewer can show which controls are actually enforced once code ships and agents start acting on their own. Assumptions about AI risk get set once and rarely get retested as usage scales. The result is a program that looks complete on a slide and thin under real use. 

Benefits of  an AISec Program Assessment
AISec Sample Output

 

.

Your Posture Gets Measured, No Guesses

Interviews with your security, AI, governance, and engineering leaders get scored against 64 observable activities, not a self-reported survey.

Your Program Gets Benchmarked Against Real Peers

Your coverage score sits against a growing data pool of organizations across banking, healthcare, government, and software.

Your Gaps Get Ranked By What Matters Most

You leave with prioritized recommendations showing which activities close the largest gap first, not a flat checklist. 

Measuring What Teams Actually Do, Not What They Claim

AISec Program Assessment was inspired by the interview-based methodology of BSIMM (the Building Security In Maturity Model), the long-running benchmark for software security programs, and applies it to how organizations govern, build, and defend AI. 

 

Confidential Interviews, Not Surveys
Practitioners map what your security, AI, governance, and engineering leaders actually do against the framework, in conversation.
64 Activities, 10 Capabilities, 3 Domains
Every organization is scored against the same catalog, across Direction & Oversight, Engineering & Usage, and Assurance & Protection.
Depth Scored, Not Just Breadth
Each activity is rated Emerging, Established, or Unobserved, so a pilot doesn’t score the same as a repeatable control.
Benchmarked Against a Real Data Pool
Your results are compared against organizations already assessed, spanning banking, healthcare, manufacturing, and government.
AISec Study

Know where you stand before you get your score.

The AISec Study benchmarks how organizations are actually building AI security programs, scored across 64 activities and 10 capabilities. Read the findings before your assessment.

Read the Study
AISecStudyReport-Cover
HOW IT WORKS

From Conversation to Prioritized Roadmap

The assessment runs as a structured engagement built around conversations with the people who run your AI program day to day.

01. Plan the engagement

You and UltraViolet identify interviewees and a start date.

02. Run practitioner interviews

Security, AI, governance, and engineering leaders walk through how AI is actually built and governed. 

03. Score against the framework

Responses map to 64 activities, each scored Emerging, Established, or Unobserved, that roll up to 10 capabilities.

 

04. Benchmark against the data pool

Your coverage score is placed against peer organizations already assessed.

05. Deliver the private report

You get a confidential report with scores, gaps, and prioritized recommendations.

1

Plan the engagement

You and UltraViolet identify interviewees and a start date. 
2

Run practitioner interviews

Security, AI, governance, and engineering leaders walk through how AI is actually built and governed. 
3

Score against the framework

Responses map to 64 activities, each scored Emerging, Established, or Unobserved, that roll up to 10 capabilities.  
4

Benchmark against the data pool

Your coverage score is placed against peer organizations already assessed.
5

Deliver the private report

You get a confidential report with scores, gaps, and prioritized recommendations. 
IN YOUR REPORT

What Your Team Gets From the Assessment

summarize Executive Summary
Summarizes your overall coverage score and the five things leadership needs to know first. 
bar_chart Capability-Level Scoring
Breaks down performance across all 10 capabilities in Direction & Oversight, Engineering & Usage, and Assurance & Protection. 
fact_check Activity-Level Detail
Shows exactly which of the 64 activities are Emerging, Established, or Unobserved in your environment. 
compare_arrows Peer Benchmark Comparison
Places your score against the data pool median and range, not a theoretical maturity model. 
trending_up Trajectory & Gap Analysis
Flags where breadth has outpaced depth so leadership can see which controls are started but not yet enforced.
checklist Prioritized Recommendations
Ranks next steps by the size of the gap they close, so your team knows what to fix first. 
SAMPLE RESULTS

Two Ways to Read Your Score

48%
COVERAGE, DEPTH-WEIGHTED
Weighted by how deeply each control sits: Established counts 1.0, Emerging counts 0.5, Unobserved counts 0. This is the score used to compare across the data pool.
 
 
 
  13 Established
  36 Emerging
  15 Unobserved
49 / 64
ACTIVITIES IN PLAY (BREADTH)
77% of the framework has at least started. The open work sits in depth, how consistently each control is enforced once it exists.
 
77% of activities started 23% not yet started
WHERE THIS SCORE SITS ON THE SCALE
Your Org - 48%
 
 
 
 
 
 
EARLY
DEVELOPING
ESTABLISHED
LEADING
 
Pool average 59%
 
Top score 85%
 
10 / 10
table-stakes controls already in place
7 / 13
frontier activities already underway
Illustrative sample data. Individual results stay confidential; only pool-level findings are published.

HEAR WHAT OUR CUSTOMERS HAVE SAID

We were happy to participate in the initial AISec Benchmark assessment in order to have that visibility into more data-driven insights and to measure and improve our AI initiatives. This allowed us to compare our practices against those of other organizations, which helps us identify potential gaps as well as gauge what to prioritize in terms of improvements. We are looking forward to continuing to work with the AISec Benchmark team to further refine and enhance our AI initiatives.

Sandy Blackwell

Global Senior Director, Software Security, 74 Software 

2642 on Inc. 5000 List of America’s Fastest-Growing Private Companies
Trailblazing Offensive Security
Trailblazing Managed Security Service Provider (MSSP)
#19 on MSSP Alert's Top 250 MSSPs
Visionary Offensive Security
Transformational MSSP

Frequently Asked Questions

 

What is the AISec Program Assessment, in one sentence?
It is a confidential, interview-based benchmark of how your organization governs, builds, and defends AI, scored against the same 64-activity framework used in the AISec Study.

AI Threat Modeling

AI systems introduce unique risks—from hidden data flows to complex model behaviors—that traditional application threat modeling simply doesn’t capture. Our AI Threat Modeling service provides a structured, model‑aware evaluation of how your AI application could be misused, manipulated, or compromised, and what controls are needed to secure it. 

What's Included

Design & configuration reviews tailored to your model and platform

We analyze architectures, integrations, model endpoints, training pipelines, and platform configurations to identify risks specific to your AI environment—not just your application surface.

Context-driven threat modeling that highlights key risks

Our threat models reflect how your AI solution actually operates—its data pathways, decision logic, access points, and dependencies—ensuring risks are prioritized based on your real deployment context.

Identification of data and model security vulnerabilities

We pinpoint areas where adversaries could exploit your system, including model manipulation, data leakage, prompt injection, alignment failures, privilege escalation, or insecure training artifacts.

READY TO SECURE YOUR AI SYSTEMS?

Understand your current AI security posture, benchmark it against peer organizations, and receive a clear, prioritized roadmap for strengthening governance, engineering controls, and runtime protection.

Get in touch to start with an AI Security Program Assessment. 

 

 

Request an Assessment