Skip to content
A prompt injection risk assessment identifies which AI tools in your organization process untrusted content, what data and systems they can access, and whether attempts to manipulate their behavior can be detected. This matters because employees increasingly rely on AI assistants and agents that process emails, web pages and files containing content from external sources.
This creates opportunities for prompt injection attacks, where malicious instructions are hidden in content an AI model processes. These instructions can manipulate the system into ignoring its intended safeguards, turning a trusted tool into a route for data theft or unauthorized actions. Knowing how to spot these is essential, which is where having a prompt injection checklist comes in.
How Should You Score Each Checklist Item?
Rate every question below with one of three answers:
- Known and controlled: low risk
- Known but uncontrolled: medium risk
- Unknown: high risk
Treat every “unknown” as high risk, because a prompt injection vulnerability you cannot see is one you cannot assess. Then prioritize tools that read untrusted content, reach sensitive data and can send information out, since that combination turns one injection into a data breach.
What Should A Prompt Injection Risk Assessment Cover?
This prompt injection checklist covers four areas, with three questions to ask of every AI tool and agent.
Exposure
- Do we have an inventory of every AI tool in use, including unsanctioned shadow AI?
- Which tools read untrusted content, such as email, web pages, shared documents or support tickets?
- Could those sources carry an indirect prompt injection attack?
Access
- What data can each tool or agent reach?
- What actions can it take, such as sending, deleting, paying or calling other tools?
- Are Model Context Protocol (MCP) servers or plugins connected, and who approved them?
Connected tools widen the impact of any injection, so MCP security and agentic AI security belong in this review.
Vendor Controls
Put these questions to every AI vendor:
- Does the tool separate trusted instructions from the external content it processes?
- Does it require human approval before high-risk actions?
- Has it been tested against Open Worldwide Application Security Project (OWASP) LLM01:2025 risks using the OWASP AI Testing Guide, including AITG-APP-01 and AITG-APP-02?
Weak answers point to gaps in prompt injection protection.
Oversight
- Would we have visibility into sensitive data leaving the organization through an AI tool?
- Do we log AI prompts and agent actions in a way that supports prompt injection detection?
- Is prompt injection covered in our incident response plan?
How Does This Checklist Map To AI Security Frameworks?
Each group maps to established frameworks, including the National Institute of Standards and Technology (NIST) AI Risk Management Framework (RMF) and MITRE Adversarial Threat Landscape for Artificial-Intelligence Systems (ATLAS). That lets compliance teams fold results into an existing AI security risk assessment.
| Framework | Use It For | Checklist Group |
|---|---|---|
| OWASP LLM01:2025 | Benchmarking for vendor defenses | Vendor controls |
| NIST AI RMF Map, Measure and Manage | Finding, rating and managing AI risk | Exposure, scoring and oversight |
| MITRE ATLAS AML.T0051 | Mapping prompt injection to known attacker techniques | Access and exposure |
| ISO/IEC 42001 | AI management system governance | All groups |
What To Do With Your Results
Unknown answers on exposure and oversight usually reflect a lack of visibility into which AI tools are in use and what data flows through them. ADX Vision 30, BlackFog’s 30-day AI exposure audit, provides the inventory and data-flow evidence this checklist asks for. ADX Vision 2.0 now extends coverage to agentic AI and prompt injection.
