The Enterprise AI Security Checklist

This chapter is built to be used, not read once. Print it, put it on a screen in a workshop, or turn it into a spreadsheet. Score each item honestly as Complete (2 points), In Progress (1 point) or Not Started (0 points).

There are 30 items across six areas. Each includes a one-line reason it matters, so you can explain the score to people outside the security team.

Area 1: Code and Vulnerability Management

1. AI-based security review runs on pull requests for critical repositories. Why: catches logic and authorization flaws before they ship.
2. Agentic discovery runs on a schedule against your highest-risk codebases. Why: finds the bugs attackers' tools will find, first.
3. Findings for crown jewel systems are merged and analyzed as attack paths. Why: chains of medium findings are where critical risk hides.
4. A software bill of materials exists and is current for critical systems. Why: you cannot respond to a dependency advisory you cannot map.
5. Cryptographic implementations and TLS configurations were reviewed in the last six months. Why: flaws in crypto code have the largest blast radius.

Area 2: Patching and Exposure

6. Critical patches reach production in 72 hours or less, measured, not policy. Why: exploitation windows are now measured in hours.
7. Low-risk environments patch automatically the same day. Why: removes volume from human queues.
8. Prioritization uses exploitation signals (KEV, EPSS, threat intel) and exposure, not severity alone. Why: you cannot fix everything; fix what will be exploited.
9. Compensating controls (virtual patching, segmentation, runtime protection) can be deployed within hours. Why: covers the gap between disclosure and fix.
10. Every critical asset has a named owner. Why: unowned systems are where patches stall.

Area 3: Machine Identity

11. A complete inventory of machine identities exists, including AI agent credentials. Why: most organizations cannot see all of theirs.
12. No secrets live in source code, CI logs or container images. Why: these are the first places an agent looks.
13. Machine credentials rotate automatically, with short lifetimes for sensitive access. Why: stolen long-lived credentials enabled the fastest 2026 intrusions.
14. Each AI agent has its own identity, scoped to least privilege. Why: over-privileged AI is associated with far higher incident rates.
15. Orphaned machine identities are found and suspended on a schedule. Why: forgotten credentials are durable, unmonitored backdoors.

Area 4: Detection and Response

16. Behavioral baselines exist for critical systems and AI agents. Why: behavior reveals exploitation of bugs nobody has found yet.
17. Tier-1 response (enrichment, evidence, initial containment) is automated. Why: humans cannot match a 29-minute breakout manually.
18. Playbooks with pre-authorized actions exist for zero-day, leaked credential, agent anomaly and third-party compromise. Why: 2 a.m. is not the time to seek approvals.
19. Your team can suspend any AI agent and revoke its credentials within minutes. Why: containment speed decides agent incident impact.
20. Incident response has access to AI analysis tools that will process real attack artifacts. Why: responders in 2026 found some commercial tools refused to help.

Area 5: People and Process

21. All security staff completed AI threat awareness training this year. Why: shared vocabulary speeds every decision.
22. Practitioners can run and triage AI security tools. Why: findings without triage only grow the backlog.
23. An internal AI red team capability exists, even if small. Why: you learn the attacker's method by using it.
24. A quarterly exercise tests a four-hour exploit and an agent intrusion. Why: plans fail where they have not been practiced.
25. Shadow AI is measured and has a sanctioned alternative. Why: unsanctioned AI was a factor in 43% of AI-related breaches in IBM's 2026 data.

Area 6: Governance

26. An AI agent governance policy defines ownership, permissions, logging and approval gates. Why: agents need rules before they need incidents.
27. Board reporting covers attack paths, remediation time and machine identity coverage. Why: vulnerability counts hide the real risk.
28. Vendor evaluations test AI security claims against your own code. Why: demos on vendor-picked repositories prove little.
29. Third-party risk reviews ask how vendors govern their AI agents and machine credentials. Why: nearly half of breaches now involve a third party.
30. Your organization participates in at least one threat-sharing community. Why: collective warning arrives before public advisories.

Scoring

Add your points. The maximum is 60.

Score	What it means	Where to focus
48-60	Strong foundation	Measure continuously, tighten timelines, expand red team scope
30-47	Real gaps with partial coverage	Close Areas 2 and 3 first; they carry the most immediate risk
15-29	Significant exposure	Start Phases 1 and 4 of the framework now; run the 90-day quick start
0-14	Critical exposure	Treat as an executive priority this quarter; begin with machine identity inventory and patch velocity measurement

How to Run the Assessment

1. Score independently first. Have the CISO, a SOC lead, an AppSec lead and a platform engineering lead each score the list alone.
2. Compare. Large disagreements are findings in themselves. If the CISO marks item 6 complete and the platform lead marks it not started, measure it.
3. Require evidence for "Complete." A policy document is not evidence of practice. A measured number, a dashboard or an exercise report is.
4. Pick three. Choose the three lowest-scoring items with the highest impact and assign owners with dates.
5. Rescore quarterly. Track movement over time. The trend matters more than the absolute score.

For a deeper look at the authentication items in Area 3, my FIDO2 implementation guide covers phishing-resistant authentication for human accounts, which removes one of the most common ways attackers reach machine credentials in the first place. For password storage questions raised in Area 1, see my password hashing comparison.

The checklist tells you where you are. The final chapter looks at where the threat is heading over the next year.

Key takeaways

• Thirty items in six areas, scored 0 to 2, give a maximum of 60.
• Areas 2 (patching) and 3 (machine identity) carry the most immediate risk for most organizations.
• Score independently, compare, and require evidence before marking anything complete.
• Pick the three lowest-scoring, highest-impact items, assign owners and dates, and rescore every quarter.