Worked assessment examples
Explore four fictional briefs and the questions a specialist-led assessment could answer. Use these examples to think through your own workflows, testing priorities and scope.
Scope · evidence · limitations
See how document processing, matter boundaries and AI-connected data become a proposed scope, with evidence and limitations made explicit.
Explore a proposed scope across application workflows, APIs and sensitive information, including test preparation and third-party boundaries.
Explore a proposed assessment of shared workspaces, application behaviour, APIs and deployment settings before rolling out a new release.
See how document access, generated output and staff-approved actions become a proposed scope before extending an internal AI assistant.
These are proposed engagements using fictional data. No assessment has been performed for these scenarios and no vulnerabilities, client endorsement or approval outcome is claimed.
| Example | System and decision | What you can learn |
|---|---|---|
| Legal workflow | A document portal with AI-assisted search; understand the risks before an internal release. | How document handling, permissions, application behaviour, AI connections and relevant configuration shape the test scope. |
| Healthcare workflow | A patient portal with a simulated clinical integration; prepare for a release decision. | How to define the integration boundary, prepare synthetic data and identify the workflows to assess. |
| SaaS platform | A platform adding shared workspaces and a partner API; prepare for a wider release. | How to define organisation boundaries, test business rules and include files, integrations and configuration in the scope. |
| AI assistant | An internal assistant preparing support-record changes for staff approval; decide whether to expand the pilot. | How to assess information access, prompt-injection risks, output handling and the controls around connected actions. |
Your assessment report
Your report brings together a clear overview for decision-makers and practical details for the people fixing the issues.
| Report section | What it contains | How it helps |
|---|---|---|
| Executive summary | A clear overview of the assessment’s key findings and their implications. | Give decision-makers a concise view of the risks that need attention. |
| Summary of findings | An overview of the individual findings in one place. | Review the issues together and plan the next steps with your team. |
| Finding details | Each finding includes a description, reproduction steps, remediation steps and references. | Help your technical team understand the issue, reproduce it and work through the recommended fix. |
Have a similar workflow or a different application to assess? Tell us what needs testing and the decision you need the results to support.