Find out where you stand, then prove it.
The assessment is the fastest way to start. It asks how your organisation secures and governs its AI across five categories, turns your answers into evidence the compliance crosswalk can use, and gives you an executive report and board deck at the end.
What the assessment covers.
Each category has its own question set, and the questions are mapped to the framework controls they evidence.
LLM Security
How models are deployed and reached: prompt security, API keys and access, output validation and filtering, and the models and APIs you depend on.
Agentic AI Risk
Agents that act: how they are designed, which tools and functions they can call, how multi-agent work is orchestrated, sandboxed and monitored.
AI Privacy & Data Governance
What data reaches AI: classification and handling, consent and individuals’ rights, personal information, cross-border transfers, retention and deletion.
Model Integrity & Supply Chain
Where models come from: provenance, dependencies and the model bill of materials, adversarial testing, versioning and rollback, bias and validation.
AI Governance & Risk Management
Who is accountable: the governance framework, regulatory alignment, incident response, ethics and transparency, audit, and board oversight.
Not covered by the assessment
Penetration testing, third-party audits, certification and legal advice. Live testing of your endpoints is the job of the platform’s probes.
Your answers become attested evidence.
Every question carries an identifier, and each framework control in the crosswalk lists the questions that evidence it. When you answer, the controls those questions map to are scored at once.
- AnswerYes, Partial, No or N/A. Yes counts 1, Partial counts 0.5, No counts 0, and N/A is left out.
- AttestEach mapped control gets an attested score: the average over the questions you answered for it.
- VerifyAs you connect the gateway, probes or sensor, live signals add a verified score to the same controls.
- ReconcileThe stronger of the two counts, unless a live signal contradicts a strong answer. Then the control is not compliant until they agree.
Evidenced by your answers. It is what the organisation says about itself, and the evidence pack labels it that way.
Proved by a live signal the platform records. It needs no one’s word, and it can overrule an answer.
An executive pack, not a findings dump.
The results page and the pack are built from the same computed view, so they always agree. Findings are grouped into a handful of risk themes, and the line-by-line register moves to an appendix.
Executive report
- Executive summary and where you stand
- Risk themes, each with its business risk
- A sequenced remediation roadmap
- Compliance impact by framework
- Appendices: the findings register, and how each score was worked out
Both name the preparer: Kapālins, or your partner’s brand when a partner runs the service for you.
Board deck
- Executive summary, and what is asked of leadership
- Where you stand, and the trajectory as findings close
- Risk themes, risk by category and compliance impact
- A Now / Next / Later roadmap, with the score reached at each stage
- How the scores are worked out
No verdict on thin evidence
A verdict is given only when at least half of the questions are answered. Below that, the pack says how much was answered and gives no verdict.
An honest peer position
A cohort is named only for your own sector, never borrowed from another. While the peer pool is modelled, the pack says so.
Nothing invented
Themes, numbers and the roadmap are derived from your findings. The same answers always produce the same pack.
Questions buyers ask.
Do we need the gateway or sensor to run an assessment?
No. An assessment can be the first thing you do. Its answers become attested evidence straight away, and live signals add verified evidence as you connect the platform.
Will the report give a verdict if we only answer part of it?
Not below half. A verdict and a peer position are given only when at least half of the questions are answered. Below that, the report says so and explains that unanswered questions are unknown risk, not zero risk.
Is the peer comparison based on real customers?
The report names a cohort only for your own sector. Until the design-partner peer pool opens, that cohort is modelled, and the report labels it as modelled.
Is the assessment a penetration test or certification?
No. It assesses policies, practices and controls. Testing against live endpoints is done by the platform’s probes, and certification is a matter for an accredited auditor.