About and methodology

howtosecure.ai helps people building or adopting AI systems find which OWASP AISVS requirements apply to them. It is a free, static tool: no accounts, no tracking, no server.

How filtering works

Every result starts with a small set of baseline requirements that apply to any AI system, such as model integrity checks, access control and logging.
Each item you tick in the assessment adds the AISVS requirements mapped to it. More detailed items only count when the item above them is also ticked.
A requirement is kept only if its AISVS level is less than or equal to the level you chose. Levels are cumulative: Level 2 includes all Level 1 requirements, and Level 3 includes everything.
Duplicates are removed and the list is sorted by requirement ID, then grouped by AISVS chapter.

The mapping from answers to requirements is in data/scoping-logic.json. The requirements themselves are in data/security-controls.json, taken from AISVS v1.01. Both files are checked for the expected structure when the page loads; if either fails, the tool shows an error instead of results.

You choose the level

The tool does not calculate a risk score or recommend a level. You pick the level by answering one question: if this AI were attacked, leaked data or gave wrong results, what is the worst realistic outcome?

Level 1: minor inconvenience; no sensitive data involved.
Level 2: personal, confidential or regulated data exposed, financial loss, or legal harm.
Level 3: harm to someone's safety, disruption of critical services, or exposure of highly sensitive personal data.

If you are unsure, consider the higher level. You can change it on the results page at any time.

Limitations

The mapping is a judgement about which requirements usually matter for each kind of system. It may include requirements you can rule out, and it may miss ones that matter in your context.
AISVS Appendix C (AI for code generation) is not included yet. If your answers match it, the results page tells you how many requirements were left out.
Withdrawn AISVS requirements are never shown.
Only OWASP AISVS is used.

Privacy

All logic runs in your browser. Your answers are kept only in this tab's session storage so they survive moving between pages. They are cleared when you start over or close the tab. Nothing is sent to a server, and there are no cookies, analytics or third-party scripts.

Disclaimer

This tool gives a starting checklist. It is not a compliance certification, audit, formal risk assessment or legal advice, and it does not guarantee coverage of every risk to your system.

Attribution and licence

Requirement text is from the OWASP Artificial Intelligence Security Verification Standard (AISVS) v1.01 by the OWASP Foundation and AISVS contributors, licensed under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0).

The data files on this site, including the scoping logic derived from AISVS, are shared under the same licence. howtosecure.ai is not affiliated with or endorsed by OWASP.