Tools

Name one accountable party (persona) per layer for a specific deployment, flag residual gaps, and export a signed one-page Decision Record (attestation) to PDF.

Identify which regulations apply to your planned AI system. Answer four questions about jurisdiction, risk tier, and deployment context to get a layer-mapped regulatory profile.

Five-layer security controls assessment aligned to the CSA AI Controls Matrix v1.0.3. Covers OWASP LLM Top 10, EU AI Act risk tiers, and generates a gap report with PDF export.

CCI-level security posture assessment across all five CoSAI SRF layers. Focused on defensive controls, threat coverage, and OWASP LLM vulnerability mitigations.

Build your AI governance document hierarchy across the five CoSAI layers: principles, policies, standards, guidelines, and operational baselines. Export as PDF or JSON.

Cross-layer integration and handoff reference. Shows how controls, data flows, and accountability transfer across the L1 through L5 boundaries for a given deployment.

Build a five-layer accountability prompt from an adversarial scenario, copy it into your own model, or use the local layer sketch. No site-held API key.

Seven AI supplier categories mapped to SRF layers. Each category states vendor-versus-customer accountability, attestation baselines, and the evidence to demand. Includes a how-to guide and a downloadable VRA workpaper.

Vendor risk for Business Security Partners at streaming providers. Five supplier families (content custody, GenAI / GenMedia, consumer AI, cloud/MLOps, M&A) with ROCA accountability and tiering for pre-release IP and member data.

Day-2 response for when a boundary fails. Seven AI incident scenarios mapped to the SRF layer that broke, with who leads per operating model, vendor asks, and evidence to preserve.

Scope an AI red team engagement. Resolves testable, authorization-required, and out-of-scope layers by operating model, pre-assigns finding ownership, and exports a signed scoping record.

Versioned, downloadable system prompts that ground AI assistants in the CoSAI SRF. Variants for executive summary, auditor, developer, and legal/procurement modes.

Prompts that read an image, Mermaid, or SVG of an AI-enabled system and write a threat matrix, a markdown report, JSON, a CSV threat database, and a Mermaid threat-model diagram. Pack v3.0 requires typed traditional analysis, checks AI-to-traditional paths, and pins external source references. Operator fields belong in the first message. Optional SRF and vertical joins run only when those inputs were supplied there.