AI Security & Scaling Readiness Scorer
Readiness isn't only "is your team ready for AI." It's also "is your security setup ready for AI, and for the growth AI is about to cause." Sixteen questions about your environment. A weighted score, the two places an incident is most likely to start, one next step, and the rules that apply to your industry and region.
What it covers: eight areas and sixteen questions drawn from NIST CSF 2.0 and the CIS Controls v8.1, weights you can move, three red flags, industry overlays for healthcare, finance and government in the US, the EU or both, a platform check for Claude and for Gemini, and a two-page PDF. What it does not cover: other industries, regions outside the US and EU, and other AI platforms. Rules and vendor settings change, so every dated fact shows the day I checked it. If something reads wrong, tell me.
Fictional example. Bettina Health Care is a made-up US medical insurer planning to expand into the EU within two years. It shows how the industry and region settings change the score, the red flags and the rules. Your first real answer clears it.
Your context
changes weights, red flags and rulesHealthcare, finance and government are scored. Other industries are not yet.
IndustryRed flags
any one blocks "Ready to scale"Platform setup check
optional · sits beside the scoreThe score above is platform-neutral. This adds eight checks for the AI platform you are rolling out, the same eight for each vendor, with each vendor's own documentation as the source. Checked . Not sponsored by either vendor.
About this tool
What this tool assumes
Why this approach
How the score works
Each area is the average of its two answers on a 1–4 scale, mapped to 0–100 (1 = 0, 4 = 100). The total is a weighted average of the areas you have answered. Weights are shares: raise one and the others shrink to keep the total at 100%. Picking an industry changes the starting weights. 75 and up: Ready to scale. 50 to 74: Scale carefully. Under 50: Not yet. A gate lowers the band when identity, logging or data handling is weak; a red flag about shared admin credentials or health data without an agreement gives Stop and fix.