# Eight questions. Two minutes. No email address.

> Eight questions, no login, no email address. See where your web, API or AI-agent security stands and which next step fits.

Answer honestly from your team’s current practice, not from the plan. At the end you see a score, the largest gap, and the package that closes it. Nothing is submitted anywhere: the result stays in this browser tab.

## 1. Are the systems, roles and data in scope written down and signed off before testing starts?

- Yes, with a named owner and stop conditions
- Roughly, in email but nothing signed
- No, the scope is agreed verbally during the work

## 2. Do you test web applications and their APIs, or only the front end?

- Both, including authenticated roles
- Mostly the front end; APIs are partially covered
- Only the front end, or nothing yet

## 3. Are AI agents, MCP tools and the data they reach inside your security testing?

- Yes, including prompt injection and tool permissions
- Partly, but not the tool permissions
- No, agents are outside our testing

## 4. Could you show a reproducible attack path, not just a finding title, for a critical result?

- Yes, with preconditions and evidence
- Sometimes, depending on who tested
- No, reports are mostly titles and severity

## 5. Does someone own remediation, and is there a retest after the fixes?

- Named owner and a dated retest
- Fixes happen; a retest is informal
- No owner and no retest

## 6. Do you know which security work your budget covers this year, and what it does not?

- Yes, with a written plan and a cost range
- A rough budget, but no plan
- No agreed budget or plan

## 7. Does one workflow already cost enough time that automating it is worth the risk?

- Yes, measured with an owner and a target gain
- Probably, but nobody has measured it
- No candidate workflow named yet

## 8. Could you tell an auditor, in one artefact, what was tested, what was fixed and what is still open?

- Yes, one current document answers all three
- Partially; the pieces live in different places
- No single artefact exists

## Your result

Score, largest gap, recommended next step.

A self-assessment, not an audit. It records your answers about process and coverage; it makes no claim about whether your systems are currently exploitable.