AI Application Security Checklist: 59 Checks by Maturity Level | Konvu

Get started

The AI Application Security Checklist<br>Time-to-exploit has collapsed from years to hours, and rogue agents are on the loose. The annual pentest, the bounty queue, the scanner backlog: all built for human speed. This is the working checklist for AI application security: how to evolve your AppSec program into an agentic loop.<br>59 checks, sorted into three maturity levels by who does the work: Reactive (humans), Automated (machines, humans approve), and Autonomous (machines, humans handle exceptions). Each level includes everything from the earlier levels, so you see both where you stand and what comes next.<br>Most programs today are not even at Reactive yet, and that is the starting line, not a judgment. Pick the level that matches your program today, and use the checklist to turn the shift to machine-speed exploitation into controls your team can actually run.<br>This list has opinions, and the occasional swear word. Both are on purpose 🙈<br>Happy Patchmageddon/Vulnpocalypse 🤙<br>Download the PDFJump to checklist<br>Free checklist. PDF download requires email.

Download the PDF<br>Free. Email required.

Pick your maturity level<br>Filter the checklist by how much of your loop still depends on humans.

Work the loop<br>Move through the loop: know your assets, find what matters, prioritize, fix, contain, and govern.

Share with your team<br>Download the PDF or share a link that preserves the controls you have checked.

Categories<br>0%0/59

All categories0/59<br>Know what can be hit0/9<br>Find what matters continuously0/13<br>Prioritize by exploitability0/6<br>Fix through automation0/12<br>Contain the blast0/8<br>Govern the machine0/11

Get the PDF<br>Download the PDFEmail required. No spam.

Verify with AI<br>Run the checklist in Claude Code or Codex locally.<br>Verify with AI

0%0/59

AllKnow what can be hitFind what matters continuouslyPrioritize by exploitabilityFix through automationContain the blastGovern the machine

Maturity levels<br>Pick your level<br>AI application security is a progression. Higher levels include the items from earlier levels.

Level 01?<br>01Reactive

Humans do the work. Tools find and report, people interpret every finding, decide what matters, and push fixes through a queue. Most programs are not here yet.

Level 02?<br>02Automated

Machines do the work, humans approve it. Agents review code, collect evidence, validate exploitability, and draft fixes. People decide what ships.

Level 03?<br>03Autonomous

The system acts on its own inside bounds humans set. Priorities update themselves, proven fixes merge, containment fires at machine speed. People handle the exceptions.

Know what can be hit<br>0/9 complete<br>Map your crown jewels, not the whole estate<br>Reactive<br>You were not keeping a perfect asset inventory before Mythos, so stop even trying. List the systems whose compromise would actually disrupt the business.

Generate and refresh SBOMs for all production services<br>Reactive<br>A current SBOM is the difference between a 2-hour and a 2-week patch decision.

Track source-control, package, and artifact provenance<br>Reactive<br>Know where every line of production code and every dependency came from.

Inventory AI agents in your environment<br>Reactive<br>Coding agents and MCP servers are a new asset class with their own vulnerability surface.

Inventory business-built apps and agent-generated automations<br>Reactive<br>Non-engineers can now ship working software. That surface still needs to enter the vulnerability loop.

Track the vendors that can reach your code, pipeline, and identity<br>Reactive<br>Your IdP, source host, CI, cloud, and AI coding tools are each one vendor breach away from being your breach.

Remove or isolate unsupported software<br>Reactive<br>End-of-life runtimes and abandoned services create findings no scanner can fix for you.

Use agents to enumerate shadow assets weekly<br>Automated<br>Asset discovery is a job that runs forever. Give it to a machine.

Contain assets that fail to identify themselves<br>Autonomous<br>An unclaimed asset that touches anything sensitive gets contained until someone claims it. The inert rest gets tagged and watched.

Find what matters continuously<br>0/13 complete<br>Run security scanners<br>Reactive<br>Scanners are still the cheapest way to find vulns, and attackers run them too. Run SCA, SAST, and secrets where it matters.

Run a coordinated vulnerability disclosure program<br>Reactive<br>Outside researchers now burn their own tokens finding your bugs. Keep the channel open; automate the reading.

Find the authorization bugs scanners miss<br>Reactive<br>Nothing crashes, no CVE fires. Scanners can't see these bugs, and coding agents keep writing them.

Split pentesting between AI and humans<br>Reactive<br>AI pentests take the cadence; humans take the targeted hard parts. Both are tests of whether your pipeline holds, not paperwork.

Rebuild test environments on demand<br>Automated<br>Every safe attack, reproduction, and fix test needs a realistic target. Regenerate it from code instead of...