Free tool
The AI software security checklist.
78 questions across 10 areas of risk, for your own product or for software you're thinking of buying.
Already started? Sign in to your assessments
What is the AI software security checklist?
Start the checklist
Assess your own product
Work through the checklist at your own pace and get a provisional risk score, section by section, with anything critical called out.
Send it to a vendor
Invite a vendor by email. They answer through a secure link, then you sign in to review their responses, ask for clarification and record your decision.
Who sees the answers
Submitted responses are stored by Hyperneph. For a vendor request they're shared with the person who sent it. Please don't enter passwords, keys or other secrets.
What it covers
10 areas of risk
- 01Company, Product and AI Development6
- 02Independent Code Review and Security Testing7
- 03Data Collection, Privacy and Ownership10
- 04Endpoint Agent and Server Communications9
- 05Hosting and Infrastructure Security8
- 06Updates, Patching and Supply Chain Security8
- 07AI-Specific Security Risks8
- 08Incident Response and Operational Resilience7
- 09Cyber Insurance, Liability and Contractual Protection8
- 10Evidence, Assurance and Deployment Approval7
FAQ
Frequently asked questions
Who can use the security checklist?
Anyone assessing software before relying on it. You can complete it for your own product, or send it to a vendor and review their answers. It is designed for AI-built applications, SaaS products, endpoint agents and AI-powered services, and works for conventionally built software too.
How does sending it to a vendor work?
Enter your details and your vendor's, then confirm your email. We email the vendor a secure link. They save their answers as they go and submit when ready. We then email you, and you sign in with a magic link to review the responses, ask for clarification and record your decision.
Who can see the answers?
Hyperneph stores submitted responses and can see them. For a vendor request, the person who sent it can see them too. A vendor's drafts stay private until they submit, and the requester's review notes and decisions are not shared with the vendor or Hyperneph.
How is the risk score calculated?
Each answered question is weighted by importance: critical 5, high 3, standard 1. The score is the weighted risk as a percentage of the applicable answered questions. Unanswered questions are reported separately as coverage. A failed critical control is flagged as a blocker whatever the overall score.
Does a low score mean the software is secure?
No. The score is a preliminary indicator based on unverified, self-reported answers, not a measure of the probability of a breach. It tells you where to look, and should be treated as provisional until the evidence has been reviewed by a person.