NEW FROM STR8IN
Hosting & Environment
Where is it hosted, and who owns that environment?
How It Works
Four questions every AI review has to answer
43 risk-weighted questions, each with guidance and the evidence to request. "Unknown" answers are rated high, so gaps never hide.
Applications & Data
What applications and data does it touch?
AI Models & Services
Which models and services run in the backend, and under what terms?
Code, Credentials & Agents
How are the code, credentials, and agents secured?
Client questionnaire link
Send a private, expiring, revocable link. Clients answer questions, add inventory, and upload evidence without an account, and never see your risk ratings or findings.
Automatic scoring
Each section is rated at its highest-risk item, and the overall rating at the highest section. Reviewers can override any answer.
Findings and reports
Findings are generated from answers rated Medium or above and tracked across reviews. Export an executive report as a PDF.
Code Scanning
Scan the code, not just the questionnaire
Share a repository URL, upload a .zip, or import SARIF, gitleaks, or npm audit results from the client's own tools. Findings land in the review automatically, and rescans update them in place.
- Each scanner runs in a throwaway container with no network
- Repository tokens and uploaded code are deleted after use
- Checks GitHub branch protection, secret scanning, and Dependabot settings
gitleaks
Secrets, including full git history
Trivy
Vulnerable dependencies, IaC misconfiguration, licences, and an SBOM
Semgrep + AI rules
LLM output reaching shell or SQL, request data in system prompts, dangerous agent tools, unsafe model loading
Bandit
Python code flaws
Checkov
CI/CD pipelines and Bicep/ARM templates
MCP analyser
Unpinned servers, stored credentials, broad filesystem access, plain-HTTP remotes
Pricing
Start with one review, or run a practice
14-day free trial with no card. Annual plans get two months free. Plans are purchased on aisecreview.com after you sign up.
Single Review
$199 one time
- 1 review workspace for 90 days
- Up to 5 code scans
- Client portal and PDF/CSV reports
Starter
$99 /month
- 3 reviews per month
- 20 code scans per month
- 2 seats
Professional
$299 /month
- 15 reviews per month
- 100 code scans per month
- 5 seats
Business
$799 /month
- Unlimited reviews
- 500 code scans per month
- 15 seats and Microsoft SSO
FAQ
Questions
Who is AI AppSec Review for?
Security consultants, MSPs, and internal IT teams who need to review an AI app or agent that a client or developer is building outside an already-audited environment such as SOC 2 or ISO 27001.
Does the client need an account?
No. You send a private, expiring questionnaire link. The client or their developer answers questions, adds inventory, and uploads evidence or code without an account, and never sees risk ratings or findings.
How is shared code handled?
Each scanner runs in a throwaway container with no network access. Repository tokens are deleted once the clone finishes and uploaded archives are deleted once the scan finishes. You can also import SARIF, gitleaks, or npm audit results instead.
Is there a free trial?
Yes. New organisations get a 14-day trial with one review, three code scans, and two seats. No card is required.
Review your first AI app this week
Start a free trial at aisecreview.com, or talk to our team about running a review for you.