How this assessment works
The assessment marks up to 21 controls from 0 to 3 on what you could show today, weights them for the deployment profile you picked, and renormalizes over what is in scope. The result is a score out of 100 and one of three verdicts. Two gates can hold a verdict down regardless of the score, and neither can lift one.
It is deterministic. The same answers always produce the same score, the same band and the same first thing to fix. There is no model in the scoring path, which is why the whole method fits on one page.
The arithmetic
Each control carries a weight for each deployment profile, and the weights for a profile sum to exactly 100. You mark every in-scope control from 0 to 3 for what you could show someone today. The score is the weighted marks divided by the weight actually in scope, as a percentage, rounded to a whole number.
earned = sum(mark / 3 * weight) over in-scope controls inScope = sum(weight) over in-scope controls score = round(earned / inScope * 100)
Marking a control not applicable removes its weight from the divisor rather than scoring it zero, so declaring something out of scope never counts against you. Controls your profile has no surface for were never in the divisor at all: a model with no tools is not graded on tool permissions, because grading it there would invent a finding.
Bands are 75 for CONTAINED AS DESCRIBED and 50 for HARDEN, anything below that is HIGH EXPOSURE. Those two numbers are not ours: they are the thresholds RedHub already ships in this lane, in the Indirect Prompt-Injection Exposure Gate and the Agent Memory & Context Poisoning Exposure Probe. Picking different ones by feel would have made this assessment disagree with the products it recommends. The numbers are theirs. The top verdict carries a longer name here, because it has to survive being read on its own.
Why two gates, and why they only ever hurt
A gate can lower a verdict and can never raise one. That is the whole mechanic, and it is the reason a verdict here means something a weighted average does not.
The kill chain. When every in-scope link on the path from untrusted content to an effect reads 1 or below, the verdict is HIGH EXPOSURE whatever the score says. The links are the controls covering retrieved content, output validation, tool scope and human confirmation. Which of them are in scope depends on your profile, and the chain needs at least two: one weak control is a weak control, while a chain is a path and a path needs more than a step. An assistant with no tools and no retrieval has fewer than two links, so it cannot trip this gate, which is the correct answer rather than a gap. A model with nothing to call cannot be made to do anything, only to say something, and the score already covers what it says.
The dark surface. A top verdict cannot sit on an in-scope control that reads zero. It is held at HARDEN instead. Without this a weighted average quietly fills the hole in: nine strong controls carry the number while the tenth, which you have not started, disappears into the mean.
Every control and its weight
21 controls across nine domains. A weight of zero means the profile has no surface for that control and it is not scored.
| Control | Assistant | Retrieval | Agent |
|---|---|---|---|
| Does the system state an instruction hierarchy, so the model knows which instructions outrank which?Instruction integrity | 11 | 8 | 7 |
| Is content you did not write kept structurally separate from your instructions, not concatenated into one string?Instruction integrity | 11 | 8 | 7 |
| Is retrieved and tool-returned content treated as data to be reasoned about, never as instructions to follow?Untrusted content | n/a | 11 | 9 |
| Does every retrieved chunk carry provenance you could trace back to a source after the fact?Untrusted content | n/a | 6 | 4 |
| Is each tool scoped to the narrowest permission that lets it do its job?Action scope | n/a | n/a | 9 |
| Does a person confirm before the system takes a high-impact or irreversible action?Action scope | n/a | n/a | 9 |
| Are the actions the system may take enumerated, not open-ended?Action scope | n/a | n/a | 6 |
| Is the model's output validated before anything downstream consumes it?Output handling | 12 | 8 | 6 |
| Is output checked for secrets, credentials and your own system instructions before it is shown or sent?Output handling | 11 | 7 | 5 |
| Is model output rendered safely, so that links, images and markup in it cannot act on their own?Output handling | 9 | 6 | 4 |
| Are the outbound destinations this system can reach restricted to an allowlist?Egress and exfiltration | 6 | 5 | 4 |
| Is there a stated limit on what data may leave in an outbound call, not only where it may go?Egress and exfiltration | 5 | 4 | 3 |
| Is anything written to persistent memory validated at the moment it is written?Memory and context | n/a | 3 | 3 |
| Is stored context re-checked when it is recalled, not trusted because it is already stored?Memory and context | n/a | 3 | 3 |
| Is memory scoped per user or session, with anything system-level held read-only?Memory and context | n/a | 2 | 2 |
| Where the system cites a source, can that citation actually be opened?Grounding and claims | 5 | 5 | 2 |
| Where a source is cited, does that source actually support the claim it is attached to?Grounding and claims | 4 | 5 | 2 |
| Is there a written set of adversarial probes you run against this system?Adversarial testing | 10 | 7 | 6 |
| Does a failed probe stop a release?Adversarial testing | 6 | 4 | 3 |
| Could you reconstruct what the model saw, retrieved and called for a given request after the fact?Monitoring and response | 5 | 4 | 3 |
| Is there a named route for reporting and acting on a suspected manipulation of this system?Monitoring and response | 5 | 4 | 3 |
The three profiles
Assistant. A model answering from its own weights plus whatever is in the conversation. No documents pulled in at run time, no tools it can call, no actions it can take. Pick this for a support chatbot, a drafting assistant or an internal helper that only ever produces text. The exposure is what it can be made to say, and what it might reveal.
Retrieval. A model that pulls in documents, tickets, pages or records at run time and answers from them. Content it never saw in training reaches it every time somebody asks a question. Pick this for a RAG assistant, a knowledge-base bot, or anything that searches a corpus before answering. The exposure is that retrieved text is attacker-writable in ways a prompt is not.
Agent. A model with tools it can call, systems it can reach and effects it can cause. It may also retrieve documents and keep memory between sessions. Pick this for anything that books, sends, writes, buys, files or changes a record. The exposure is everything the other two have plus everything a hijacked instruction can reach.
What this assessment cannot do
It cannot verify a single answer. Nothing here touches your system, fetches a URL you supply or reads a line of your code, and that is a deliberate limit rather than a missing feature: a security tool that fetches a target somebody types into it is a proxy for attacking third parties.
It is not a penetration test. A penetration test attacks a running system and reports what it achieved; this reads a design and reports what would happen. It is not a certification, because nothing certifies a language model system as secure. And no assessment of a design can rule out an attack nobody has thought of yet, which is why the top verdict is called CONTAINED AS DESCRIBED and not contained. It reports what your answers show against the failures this assessment knows how to describe. It says nothing about whether the system is safe, and the two are not the same claim.
Where the assessment names a gap that nothing on the RedHub shelf addresses, it says so and recommends nothing. What we sell against these gaps is listed in full, and the monitoring domain has no product behind it on purpose.
Common questions
- Why does the number of questions change when I change profile?
- Because the questions follow what the system can reach. A model with no tools has no tool permissions to scope and no action to confirm, so those controls carry a weight of zero for that profile and drop out entirely. Their weight leaves the divisor as well, so a dropped control is not a silent failure.
- Where do the bands come from?
- From products RedHub already ships in this lane. The Indirect Prompt-Injection Exposure Gate and the Agent Memory & Context Poisoning Exposure Probe both put their top band at 75 and their middle band at 50, so this assessment uses the same two numbers. Choosing different thresholds by feel would have made a free assessment disagree with the paid tools it recommends.
- Why can a gate only ever lower a verdict?
- Because a weighted average is the wrong instrument for a structural failure. Nine strong controls can carry a score while the one thing standing between a hostile document and an action is missing, and averaging is exactly what hides that. A gate is the place where one specific fact overrides the summary, and letting it work in the other direction would make it a bonus instead of a limit.
- Why does the kill chain need at least two links?
- Because one weak control is a weak control, while a chain is a path and a path needs more than a step. Calling a single low mark a complete route from untrusted content to an effect would overstate what the answers show.
- Can I check the score by hand?
- Yes, and that is the point of publishing every weight on this page. Multiply each mark by its weight, divide by three, sum them, divide by the weight in scope and multiply by a hundred. The result is deterministic: the same answers always produce the same score, the same band and the same first thing to fix.