AI and Intelligent Automation Assessment

Vibe Coding Security and Governance Maturity Assessment

Evaluates an organization's ability to govern AI-assisted software development, from policy and prompt security through code review, supply chain controls, security scanning, accountability and continuous improvement.

Already have an account? Log in to start

At a glance

Questions: 25
Domains: 4
Working time: Initial assessment: 60-90 minutes with an engineering lead and an application security representative, with input from legal. Evidence gathering: 1-2 weeks, including a sample of AI-assisted pull requests, scan results and dependency logs. Reassessment: 45-60 minutes.
Repeat: Quarterly, because AI coding tools change quickly, and within 30 days of adopting a new AI coding tool, a security incident involving AI-generated code or a major change to the development pipeline.
Roles: 5
Updated: October 2026

Who it is for

Engineering Leadership and Architecture
Application Security
Development Teams
Legal and Compliance
Process Owner/Full Model Assessor

CTO / VP Engineering / Engineering Lead / AppSec and DevSecOps Lead. Secondary: software architects, code reviewers, legal and compliance.

What you will gain

Shows whether AI-assisted development is governed or merely tolerated, exposes where code, secrets, vulnerabilities and legal risk slip through, and gives each gap a concrete next step and a measurable target.

About this assessment

Vibe coding, using AI to generate code through natural language prompting, is changing how software is built. Developers produce more code faster, but that speed brings new risks: proprietary code and secrets sent to external AI services, plausible but wrong logic that passes a quick review, hallucinated or typosquatted packages, license contamination from training data, and technical debt that builds up quietly.

This assessment follows the order in which those risks have to be governed. It starts with Policy and Input Protection (the ground rules, approved tools, IP position, restrictions on security-critical code and controls on what goes into prompts), then Code Review and Quality Assurance (identifying AI code and reviewing and testing it with the right skepticism), then Supply Chain and Security Scanning (validating what AI suggests and scanning what it produces), and closes with Accountability and Continuous Improvement (who owns AI code, what the data shows and how standards evolve).

Each question is scored on whether the capability is documented, implemented and effective, so the results separate governance that exists on paper from governance that works, and name Paper Tigers, Tribal Knowledge and Measurement Gaps. Every score comes with specific guidance on what to fix next. DevSecOps and Shadow AI and AI Sprawl Governance are companion models.

What we assess: 4 domains

Each domain is a group of related questions, scored on its own and rolled up into your overall result.

01 · 8 questions

1 Policy and Input Protection

AI-assisted development policy, approved tools and boundaries, IP position, security-critical restrictions, proprietary code, secrets and regulated data in prompts, retention and training awareness

02 · 5 questions

2 Code Review and Quality Assurance

AI code identification, review rigor, reviewer pitfall training, testing standards, architectural consistency

03 · 7 questions

3 Supply Chain and Security Scanning

Hallucinated packages, dependency vulnerability scanning, lockfiles and integrity, typosquatting, SAST and DAST coverage, AI-specific rule tuning, license scanning

04 · 5 questions

4 Accountability and Continuous Improvement

Developer accountability, security feedback loop, AI versus human quality metrics, productivity versus technical debt, standards evolution

KPIs to track

Measures that show whether the improvements hold.

KPI
AI Code Vulnerability Density - Vulnerabilities per 1,000 lines of AI-generated code compared with human-written code. Target: equal or lower.
Restricted-Area Detection Rate - Share of AI-generated changes in security-critical areas caught before merge. Target: 100%.
Hallucinated Package Catch Rate - Share of non-existent AI-suggested packages caught before installation. Target: 100% in controlled tests.
AI Code Review Rejection Rate - Share of AI-generated pull requests needing revision after review. Target: tracked and trending downward.
Vulnerability Recurrence Rate - Share of previously found AI code vulnerability types that reappear. Target: declining every quarter.