An evidence-based assessment of the AI your business uses and builds, the controls protecting it and the priorities that should shape your next investment.
Bring your control environment and actual AI use into one conversation. Turn what we learn into a practical, risk-based roadmap for the AI you build and consume.
Assess applicable security controls against MITRE SAFE-AI, complemented by governance criteria. Establish what is documented, implemented and supported by evidence.
Discover approved and shadow AI across the agreed scope. Identify applications, models, agents, connectors, data exposure and activity. Make coverage limits visible.
Combine context and evidence. Assess use-case risk, select proportionate controls and define the path toward an AI control plane.
Assess applicable security controls using MITRE SAFE-AI. Complement the security assessment with governance and broader AI Clarity criteria, tailored to the agreed scope.
Identify known AI uses, system boundaries, data, business consequences and supplier responsibilities. Determine which controls apply before assessing them.
Combine interviews, policies, configurations, records and agreed tests. Establish whether controls are designed, implemented and effective. Record unknowns separately.
Connect observations and gaps to business implications. Identify themes across governance, access, data protection, lifecycle and operations.
Pillar 2 adds observed AI use and coverage information. New agents, integrations or exposures can change the applicability and risk assessment.
SAFE-AI is the security reference foundation. The wider AI Clarity method and its scoring are Ascendra proposals. This is not a MITRE certification.
Build on the technology you already have. Establish where it provides usable evidence, where visibility ends and whether purpose-built discovery can close material gaps.
Use available endpoint, browser, SaaS, identity, cloud and network evidence. The resulting inventory depends on source access, telemetry coverage, observation time and what the products can actually identify.
Where agreed, evaluate additional discovery for AI-specific context, agents, connectors and activity. Validate actual coverage in your environment; no tool guarantees complete discovery.
Purchased tools and embedded features. Assess intended use, information shared, integrations, reliance on outputs and the split between supplier and customer responsibilities.
Applications, retrieval systems and agents. Extend the assessment to data pipelines, prompts, models, tools, deployment and ongoing operation.
A purchased model connected to internal data and tools can involve both. Assess what the system does and what your organization controls.
A person reviews the output before use. No sensitive information or connected action is involved.
Routine approval under delegated authority, with a clear route to report problems.
Start with your use cases, priorities and existing controls. We’ll help define a practical assessment scope.
Book ConsultationTake the complimentary AI Runtime Readiness Self-Assessment. Get your executive result before deciding whether to request a deeper review.
Check my AI readiness ↗