Free guide
The AI section of the security questionnaire, explained
Twelve questions enterprise buyers now ask about AI features, why they ask, and what a strong answer contains. Questions 1 to 5 and 10 are the ones you can back with test evidence.
1. Is the AI feature tested against prompt injection? When, and how?
Why they ask: Buyers want a date, a method and a result, not a policy statement.
A strong answer: Name the test (automated adversarial suite or manual red team), the date, the endpoint tested, the number of attempts, and the outcome.
2. Can the system prompt or hidden instructions be extracted?
Why they ask: Leaked prompts expose business logic, internal URLs and guardrails.
A strong answer: Report extraction attempts and results, and what mitigations (output filtering, prompt design) were applied and retested.
3. Can one customer's data appear in another customer's session?
Why they ask: Cross-tenant leakage is the deal-breaker for shared RAG and chat history.
A strong answer: Describe tenant isolation in retrieval and memory, then show probe results from a second tenant account.
4. Can instructions hidden in documents, emails or web pages hijack the model?
Why they ask: Indirect injection is the most common real-world path.
A strong answer: Show tests with poisoned documents and what the model did with them.
5. What actions can the AI take (tools, APIs, refunds, emails) and how are they limited?
Why they ask: An injected agent with broad permissions is a breach.
A strong answer: List tool permissions, confirmation steps, and tests asking for out-of-scope actions.
6. Is customer data used to train models?
Why they ask: A standard data-use question.
A strong answer: State it plainly, with the provider's contractual terms.
7. Which model providers and sub-processors are involved?
Why they ask: Vendor-risk teams map the data flow.
A strong answer: List providers, regions and retention settings.
8. How are AI logs stored, and who can read them?
Why they ask: Prompts often contain personal data.
A strong answer: State retention period, access controls and redaction.
9. How do you handle harmful or inaccurate outputs?
Why they ask: Reputational and compliance risk.
A strong answer: Describe output checks, escalation paths and user reporting.
10. Do you retest after fixes?
Why they ask: A one-off test proves little.
A strong answer: Keep a dated before/after record: what failed, what changed, what the retest showed.
11. How often is the AI feature re-assessed?
Why they ask: Models and prompts change.
A strong answer: Commit to a cadence (for example, on each major prompt or model change, and at least quarterly).
12. Who is accountable for AI security?
Why they ask: Reviewers want a named owner.
A strong answer: Name the role, even if it's the CTO.
Want tested answers instead of promises? Probepack attacks your AI endpoint and gives you a dated evidence pack.