Look for documented goals or objectives approved by appropriate security, engineering, or executive leadership. Evidence may include AppSec strategy documents, AI governance materials, security program objectives, executive planning materials, risk appetite statements, or security transformation roadmaps. The goals should cover all relevant AI usage types at a strategic level and should be specific enough to guide policy, KPIs, ownership, investment, and implementation planning. This signal does not require detailed operational procedures or full implementation.

Look for approved policy or standards language that addresses AI-related AppSec expectations. Evidence may include Secure SDLC standards, engineering security policies, AI governance policies, release governance requirements, secure development guidelines, or security architecture principles. The policy should address relevant AI usage types, including secure use of AI-assisted development, security expectations for AI-enabled application functionality, and preparedness for AI-accelerated vulnerability discovery. This signal assesses whether expectations are codified at the governance level; it does not require full operational rollout or technical enforcement.

Look for executive or senior-leadership reporting that includes AI-integrated AppSec metrics. Evidence may include CISO dashboards, AppSec scorecards, quarterly business reviews, risk committee materials, security program reporting, or governance updates. KPIs should be tied to the organization’s AI-integrated AppSec goals and should be meaningful for decision-making. They may include indicators such as AI-enabled application exposure, AI-related risk trends, remediation performance, adoption of AI-assisted AppSec capabilities, and preparedness for AI-accelerated vulnerability discovery. This signal focuses on executive visibility and management use, not the existence of every possible metric.

Look for evidence that AI-enabled applications, services, components, or integrations are captured in the organization’s existing application inventory, asset inventory, CMDB, ASPM platform, or portfolio management process. The classification should include AI-specific risk factors and should influence AppSec attention, testing depth, remediation priority, exception handling, or management reporting. This signal does not require perfect automated discovery, but it should go beyond informal awareness or one-off spreadsheets.

Look for documented threat models, architecture risk reviews, security design reviews, or equivalent artifacts for AI-enabled applications. Evidence should show that AI-specific risks are considered, not only generic application threats. The organization may define scope based on risk tier, external exposure, data sensitivity, AI capability type, or release criticality. This signal does not require every low-risk AI use case to be threat modeled, but it should show a defined and consistently applied approach for relevant applications.

Look for documented release criteria, risk acceptance rules, security gates, escalation procedures, or approval standards that include AI-related risk factors. Evidence may appear in Secure SDLC processes, release governance, AppSec review procedures, risk management workflows, or platform policies. The thresholds should be actionable and consistently applied to relevant AI-enabled applications. This signal does not require automated blocking in every pipeline, but the criteria should influence release decisions and exception handling.

Look for AI-assisted capabilities used in AppSec, ASPM, AST, ticketing, developer workflow, reporting, or remediation management processes. Evidence may include AI-supported triage, finding explanation, duplicate grouping, prioritization, routing, remediation guidance, secure code suggestions, reporting automation, or workflow analytics. The organization should have expectations for validation, quality control, and responsible use. This signal does not require fully automated remediation; it assesses whether AI is used responsibly to improve AppSec workflow outcomes, especially remediation speed and quality.

Look for evidence that security testing and detection practices used by engineering teams have been updated for AI-assisted development risks, AI-enabled application risks, and AI-accelerated offensive capability. Evidence may include updated SAST, SCA, IaC, secrets, API, DAST, threat-informed testing, custom rules, workflow integrations, or AI-enhanced analysis in pull requests, CI/CD, IDEs, issue tracking, or developer portals. This signal does not assess whether the organization can identify AI-generated code. It assesses whether relevant risks are detected and surfaced effectively in development workflows.

Look for AST, ASPM, application inventory, security testing, architecture, or platform capabilities that help teams identify and manage AI-related application risk. Evidence may include detection rules, integration discovery, AI exposure tagging, correlation of AI functionality with findings, specialized testing coverage, dashboards, or workflow support. This signal does not require a single tool to do everything, but the overall platform architecture should enable scalable, repeatable management of AI-related application risks.

Look for AI-enabled capabilities in AST, ASPM, ticketing, developer workflow, reporting, or security analytics processes. Evidence may include AI-assisted finding correlation, noise reduction, remediation guidance, triage support, issue grouping, reporting generation, or prioritization recommendations. The organization should be able to show that these capabilities are used responsibly and improve AppSec outcomes. This signal does not require fully automated decision-making or remediation.

Look for planning artifacts such as roadmaps, rollout plans, program plans, adoption plans, budget plans, milestone trackers, implementation backlogs, or delivery plans. The roadmap should include ownership, sequencing, target populations, coverage milestones, dependencies, and success criteria. It should connect strategic intent to practical execution across security, engineering, AppSec, platform, and program stakeholders. This signal assesses planning and rollout readiness, not whether every capability is already fully implemented.

Look for training plans, enablement materials, learning paths, completion metrics, onboarding content, workshops, secure development guidance, or role-specific playbooks. Training should be tailored to relevant roles and should include coverage expectations or completion targets. Evidence should show that education supports practical adoption of AI-integrated AppSec practices. This signal does not require a single training course for everyone; differentiated role-based enablement is preferable.