You can't secure every AI risk at once. Employees are already using personal ChatGPT accounts on corporate devices, development teams are shipping code written by AI agents, and threat actors are compressing exploit windows to hours instead of weeks. The question isn't whether AI creates risk, it's which risks will actually harm your business if they materialize.
This checklist helps you identify and prioritize AI-related risks using a business-impact framework. It's designed for security leaders who need to make defensible decisions about where to invest limited resources when the AI threat landscape changes faster than your budget cycle.
Checklist Overview
This is a prioritization framework, not an exhaustive control catalog. You'll identify where AI is already operating in your environment, assess which risks carry the highest business impact, and implement controls that address your specific exposure. Each item includes what "done" looks like so you can track progress and explain your decisions to the board.
Prerequisites
Before you start:
□ Secure executive sponsorship for AI risk assessment
You need authority to ask questions across business units and access to budget data for AI tools. Good looks like: your CFO or COO has explicitly authorized cross-functional discovery and will receive your findings.
□ Define "business-critical" for your organization
What systems, data, or processes would cause material harm if compromised? Good looks like: a written list of crown jewels that your executive team has reviewed, ranked by potential financial or operational impact.
□ Establish baseline security controls
This checklist assumes you have basic identity management, network segmentation, and logging in place. If you're still working on foundational controls, address those first; AI doesn't change the fact that you need working IAM.
Risk Identification and Prioritization
□ Inventory AI tool usage across all business units
Survey teams to identify which AI tools they're using, including personal accounts on corporate devices. According to Verizon's DBIR, 45% of employees are regular AI users on corporate devices, and roughly two-thirds use personal accounts outside enterprise controls. Good looks like: a spreadsheet listing every AI tool in use, the team using it, whether it's sanctioned, and what data it accesses.
□ Map sensitive data flows to AI systems
Identify which AI tools have access to customer data, intellectual property, financial records, or regulated information. Good looks like: a data flow diagram showing which AI systems can reach which data classifications, with explicit callouts for tools operating outside your DLP perimeter.
□ Identify autonomous agent deployments
Document where AI agents can take actions without human approval, coding assistants that commit to production, customer service bots that access account data, internal copilots with broad system permissions. The PocketOS incident in April 2026 showed how an AI coding agent deleted a production database when it hit a credential mismatch and attempted to "fix" the problem autonomously. Good looks like: a list of every agent that can execute API calls, modify data, or access credentials, along with the scope of its permissions.
□ Assess internet-facing attack surface
Catalog your public APIs, web applications, and any software you ship to clients. These are the targets for AI-accelerated reconnaissance and exploitation. Google's Threat Intelligence Group reported the first AI-developed zero-day this spring, a two-factor bypass written in Python. Good looks like: a current asset inventory with vulnerability scan results and mean time to patch metrics for external-facing systems.
□ Calculate financial exposure from usage-based billing
If you use token-based AI services, determine your maximum monthly exposure if API keys were compromised and used to run up charges. The Resilience Risk Operations Center has observed stolen API tokens being abused for significant financial losses. Good looks like: billing alerts configured at 150% of normal usage and rate limits set on all API keys tied to paid AI services.
□ Rank risks by business impact
Score each identified risk based on potential financial loss, operational disruption, regulatory exposure, or reputational harm. This is where you decide what to fix first. Good looks like: a risk register with dollar estimates or operational impact hours for each scenario, sorted by severity, that you can defend to your CFO.
Control Implementation
□ Enforce role-based access control for AI systems
Ensure AI tools and agents only access data necessary for their function. This limits blast radius if an agent behaves unexpectedly or an account is compromised. Good looks like: every AI system operates with least-privilege permissions that you've documented and tested, and no agent has broader access than the human role it's supporting.
□ Classify sensitive data and block it from unsanctioned AI tools
Tag data that shouldn't leave your environment and configure DLP policies to prevent it from reaching personal AI accounts or unapproved platforms. Good looks like: your DLP solution blocks uploads of classified data to consumer AI sites, and you've tested it with real prompts employees might use.
□ Implement continuous vulnerability testing
Deploy automated scanning and penetration testing against your internet-facing assets. Researchers from CodeWall deployed an autonomous agent against McKinsey's AI ecosystem and gained full read-write privileges within two hours via SQL injection. Good looks like: weekly automated scans of external assets, quarterly penetration tests that include AI-assisted attack scenarios, and a defined SLA for remediation based on CVSS scores.
□ Establish code review gates for AI-generated code
If your developers use AI coding assistants, require human review before AI-written code reaches production. Good looks like: a CI/CD pipeline that flags AI-generated commits for mandatory peer review, with automated checks for common vulnerability patterns like SQL injection or hardcoded credentials.
□ Configure billing alerts and rate limits
Set spending caps on AI API keys and alerts at unusual usage thresholds. Good looks like: rate limits configured on all production API keys, billing alerts that trigger at 150% of baseline, and a documented process for investigating usage spikes within four hours.
□ Scope AI agent permissions explicitly
For each autonomous agent, document exactly what actions it can take and restrict its access accordingly. Good looks like: written permission scopes for every agent that you've tested in a sandbox environment, with explicit denials for destructive operations like database deletion or credential modification.
Common Mistakes
Treating AI risk as a separate program. AI risk is business risk. If you build a parallel "AI security" initiative, you'll duplicate work and miss integration points. Fold AI considerations into your existing risk framework.
Waiting for perfect visibility before acting. You'll never have complete visibility into shadow AI usage. Start with the highest-impact risks you can identify today and iterate.
Focusing exclusively on external threats. Your employees' use of personal AI accounts on corporate devices creates more immediate exposure than most external attack scenarios. Address internal governance first.
Implementing controls without business context. Blocking all AI tools might reduce risk, but it'll also trigger a revolt from your product team. Understand what your business actually needs AI to do, then secure those use cases.
Skipping tabletop exercises. You haven't tested your incident response plan for a compromised AI agent or a disrupted AI service your business depends on. Run the scenario before you're forced to respond to it live.
Next Steps
Brief your executive team on your risk ranking within 30 days. They need to understand which AI risks you're addressing and, more importantly, which ones you're accepting.
Establish a quarterly AI risk review cadence. The threat landscape is changing too fast for annual assessments. Block time every quarter to revisit your risk register and adjust priorities.
Build AI scenarios into your security training. Update phishing simulations to include AI-generated content. Test whether your teams can spot the difference.
Connect AI risk to your existing frameworks. Map your AI controls to NIST CSF or ISO 27001 so you're not maintaining a separate compliance narrative.
The CISOs who succeed with AI risk won't be the ones who secure everything, they'll be the ones who secure what actually matters to their business, in the right order, with controls they can explain and defend.
