Free resource · AI security
The AI Application Security Review Checklist
One afternoon with the team that built your assistant, 28 questions, and a record of what you actually saw. Built for practitioners reviewing a chat assistant, a RAG assistant, a copilot with tools or an agent.
What's inside
- Seven domains, 28 checks: inputs and data sources, retrieval, model and prompts, tools and agency, output handling, operations, governance.
- 15 checks marked Deterministic, because they hold even when the model is fooled. Do those first.
- A column for the evidence you saw, so "someone said so" never counts.
- References to OWASP LLM Top 10 (2025 and 2026 editions), NIST AI RMF and the Generative AI Profile, CISA/NSA and NCSC guidance, MITRE ATLAS.
- An editable spreadsheet with a dropdown result column and a summary that totals itself.
Read first: Prompt Injection Explained Through a RAG Assistant Scenario.
Get the checklist
Who made this
InfoSecables Insights is written by Owen Dubiel, a working security practitioner and the founder of InfoSecables. Every guide and download is built from public standards and self-built labs, and checked against the cited sources before it is published.
Independent and vendor-free: see our disclosures and privacy policy.
