Assess every AI system against the risks that matter to your organisation, translate those findings into a clear risk level, and keep the decision current as the system evolves.
Strai8 assesses each AI system across the risk dimensions that matter to its use, then turns the results into a clear decision and the actions required to move forward.
Model tests measure the system against your data. Adversarial tests attack it while it runs. Regulatory assessments classify it against the rules that apply. Vendor assessments cover the part you didn’t build. And when your own policy asks something none of them do, you write that assessment yourself.
Each run is scored against the baseline the system was approved on, in the direction that counts as degradation for that metric, and across every group large enough to be significant. Classification, regression and ranking models are all first-class.
These assessments attack the running system the way an adversary would, and report what got through and what held. A result that fails does not sit in a report — it raises an alert against the system and its owner.
Most of the questionnaire is already answered by the register and by discovery; you answer the judgement calls a person has to make. Every branch of the outcome carries the article that produced it, and a high-severity trip blocks deployment until it is cleared.
You did not build most of the AI in your estate. These assessments cover what a provider does with your prompts and your data, what they will put in writing, and who sits behind them — against the system in your register that depends on them.
When the question your policy asks is not in the library, you write the assessment. Define the sections and the questions, choose how it scores, set the bands and the threshold that raises an alert — and it appears in the catalogue beside everything else, with the same runs, the same record and the same alerts.
A risk rating is only useful when you know what was tested, what was found, and what still needs attention.
Have all of our AI systems been assessed?
Every AI system, with an assessment status.
Know which systems have been assessed, which are pending, and where a risk decision has not yet been made.
Have our systems been tested for bias, drift, and performance degradation?
Measured against defined baselines.
Track fairness, model performance, data drift, and other metrics that can indicate when an AI system is no longer behaving as expected.
Can the system be trusted with the data it depends on?
Data quality and resilience are part of the risk decision.
Assess data quality, completeness, distribution changes, sensitive-data exposure, and other conditions that can undermine model reliability.
Has the system been tested for security and adversarial risk?
Know how the system behaves under attack and unexpected use.
Evaluate prompt injection, jailbreaks, unsafe behaviour, adversarial inputs, and other security conditions relevant to the AI system.
What risk are we accepting, and what needs to change?
A clear decision with actions behind it.
See the final risk level, the factors driving it, required mitigations, accountable owners, and when the system should be reassessed.
AI systems keep moving after they are approved. Strai8 holds the run the system was cleared on as the baseline, runs the assessments again when something changes underneath it, and reopens the decision when a result crosses the threshold you set.
An assessment should do more than return a score. It should say what was run and against what, what it found, what has to change before the system ships, and what it settles for the frameworks you already answer to.
Thirty minutes, on your own estate. We'll run the assessments against it, show you what each one found, and leave you the record.