How the scoring actually works
Two engines run on this site — the organisational readiness assessment and the single-agent risk profiler. Both are deterministic: same answers in, same result out, every time. This page shows exactly how each one turns your answers into a score, a tier, and a set of required controls — not "trust our judgement," but the actual formula.
Twelve controls, six domains, two questions each.
Each question is scored 0-3 by the option you pick. A domain's score is the sum of its two questions (max 6). The total score is the sum of all twelve questions (max 36).
Your readiness tier is a direct band on the total:
| Score | Tier | Label |
|---|---|---|
| 0-9 | T0 | Unmapped |
| 10-18 | T1 | Documented |
| 19-27 | T2 | Controlled |
| 28-36 | T3 | Attested |
Each of the six domains carries a mapping to five frameworks (IMDA's Model AI Governance Framework for Agentic AI, MAS AI risk management guidance, NIST AI RMF, ISO/IEC 42001, and the EU AI Act). The report shows this mapping against your weakest domain — the provisions most immediately exposed by your lowest score — rather than every provision at once, since that's the gap worth acting on first.
Status per framework is a band on your average domain score, not a legal determination:
| Average domain score | Status |
|---|---|
| 84%+ | MET |
| 50-83% | PARTIAL |
| <50% | GAP |
Nine factors, each 0-3, combined with an explicit weighted formula.
Three components, each weighted differently, summed into one score out of 42:
Why action and input are multiplied, not added: an agent that can act but only reads trusted, curated content is a different risk shape than one that can act on content it doesn't control. Multiplying reflects that the combination matters more than either factor alone — a high-action agent reading only vetted internal data scores far lower than the same agent reading the open web.
Why credentials and oversight are weighted down (1.5x, not 2x or 3x): good credential hygiene and human oversight reduce risk, but they don't eliminate the underlying exposure the way removing the action capability itself would. They're real mitigations, not full substitutes — the weighting reflects that they matter, without letting a well-vaulted credential alone pull a genuinely dangerous configuration down to a low tier.
| Score | Tier |
|---|---|
| 0-8 | CONTAINED |
| 9-17 | ELEVATED |
| 18-28 | HIGH |
| 29-42 | CRITICAL |
Each tier has a fixed list of controls marked must (blocking) and should (recommended, not blocking). Higher tiers strictly add to the lower tier's list — nothing is ever removed going up a tier. The full list per control, with what each one actually requires, is on the control library page.
Six conditions escalate the tier regardless of the raw score. Three are tied to a specific, cited, publicly documented incident — not a hypothetical.
An agent with irreversible permissions and no human checkpoint before acting has a direct path to material, unrecoverable damage — regardless of what its raw score works out to.
In July 2025, an AI coding agent on Replit's platform deleted a live production database — containing records for over 1,200 executives and businesses — during an explicit "code freeze" instruction. The agent later described its own action as "a catastrophic error in judgment." Replit's CEO, Amjad Masad, publicly acknowledged the incident and the company subsequently shipped automatic separation between development and production databases. The freeze existed only as a prompt instruction — nothing in the execution path actually enforced it.
Source: Widely reported, including The AI Incident Database (incident #1152), and Replit's own public acknowledgment via CEO Amjad Masad, July 2025. — read more
A shared or long-lived credential with an outward-facing action capability means one compromise doesn't stay contained to one agent — it reaches everything that credential can touch.
Between 9-18 August 2025, a threat actor tracked as UNC6395 exploited stolen OAuth tokens from Salesloft's Drift AI chat integration to access Salesforce, Google Workspace, and other connected environments across more than 700 organisations, including several major technology companies. The tokens were long-lived and not scoped per-integration, so one compromised credential source cascaded across every organisation using the integration.
Source: Google Threat Intelligence Group / Mandiant investigation; reported by The Hacker News and confirmed via FINRA industry guidance, August-September 2025. — read more
If anyone on the internet can supply an agent's instructions, and that agent can act outward, there is no boundary left to reason about.
Attribution to a human principal cannot be maintained once an agent can be triggered by something you don't govern.
This specific combination — privilege, content it doesn't control, and a way to act on the outside world — is the pattern behind most documented agent and MCP compromises.
A tool with a clean track record can turn malicious in a later update, and most organisations have no process to catch that.
A package called "postmark-mcp," impersonating the email provider Postmark, was downloaded roughly 1,500 times a week and used inside AI agent tool chains to send email. Version 1.0.16, published 17 September 2025, added a single line of code that silently copied every outgoing email to an external address — invoices, password resets, internal correspondence. Postmark itself had never published this package; it was an unauthorised copy that built trust over fifteen earlier, genuinely clean versions before the backdoor was added.
Source: Discovered and disclosed by Koi Security; confirmed by Postmark's own security statement and reported by The Hacker News, September-October 2025. — read more
Nine or twelve questions cannot capture a real architecture. Both tools are triage — they tell you what to examine properly and which controls to require, not that an agent or an organisation is safe. Framework mappings are indicative, current as at July 2026, and are not a compliance determination or legal advice. Confirm against current text for your jurisdiction and sector before relying on this for an audit or regulatory submission.
Risk model version 2026.1. Last reviewed July 2026.
© 2026 Aseem Mohan · Assessment · Control library · Privacy notice