AI-SHIELD · Free tool by Kris McCabe
An 18-question maturity assessment across six pillars — Supply chain, Human oversight, Identity & access, Evaluation, Logging, and Data — with evidence-anchored scoring and a governance cap designed to resist self-assessment inflation.
Why not just use what exists
Every major AI security framework published in the last two years — NIST's AI RMF, ISO/IEC 42001, the Cloud Security Alliance's 243-control AI Controls Matrix — is built for an organization with a security team and months to run an audit. AI-SHIELD is scoped differently on purpose: eighteen questions a person who actually built or operates the system can answer honestly in fifteen minutes.
| Framework | What it actually is | Time to a score |
|---|---|---|
| NIST AI RMF + GenAI Profile | 72 subcategories across 19 categories | Weeks |
| ISO/IEC 42001 | Certifiable management system, audit cycle | Months |
| CSA AI Controls Matrix | 243 control objectives, 18 domains | Weeks |
| OWASP LLM / ASI Top 10 | Ranked vulnerability lists, no score | N/A |
| AI-SHIELD | 18-question self-assessment | ~15–20 minutes |
Each pillar maps to a real, current body of work — condensed into three questions.
Three design decisions push back on self-assessment inflation.
Every level (0–4) describes a concrete, checkable state — a document that exists, a test that ran — not a vibe.
Your Human Oversight & Governance score acts as a ceiling: the overall score can't exceed it by more than one point.
Any question scored 0 — a total absence of a control — surfaces as a named Critical Gap in your results, independent of your overall score.
All eighteen questions, in detail, with the specific control each one maps to in other frameworks, and why each one matters in plain terms.
AI-SHIELD doesn't invent risks — it re-scopes real, current frameworks into something answerable in one sitting.
Ready to see where you stand?
Give it a name so you can keep it separate from other systems you assess later — e.g. "Customer support agent, production". Assessing several AI systems separately is more honest than blending them into one score.
Select all that apply — most systems aren't just one of these. This sets a short context note under each pillar as you go; it doesn't skip or hide any questions.
Answer all 18 questions to see your results.