Security Questionnaire: Answering for an AI Agent You Ship

Why do clients send security questionnaires about AI agents?

Because an agent is not a website: it reads data, calls tools and takes actions on behalf of the company. Client security and procurement teams reuse their usual questionnaires (hosting, access, backups) and add agent-specific questions: prompt injection, data leakage, actions without approval, model providers.

The frameworks they cite most are the OWASP Top 10 for LLM Applications 2025 (LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM06 Excessive Agency, among others) and the MITRE ATLAS matrix. If you know them, you can structure your answers on the same categories as your counterpart.

For an agency, the questionnaire is also an opportunity: a clear evidence file shortens the sales cycle. AI agencies that deliver agents to their clients can find more details on our white-label approach.

How do you answer without over-promising?

Answer with what is verified, and date it. A solid answer contains three elements: what is in place, the matching proof, and the known limit. Avoid absolutes ("the agent cannot be manipulated"), which no test can establish.

Practical rules:

• One answer, one proof: every "yes" points to a document, a screenshot, a configuration excerpt or a report.
• Date and version: "tested on October 12 on agent version 1.4" beats "tested".
• Write the limits: for example "the agent has no access to record deletion; sending emails requires human approval".
• Separate what is yours from what is the client's: hosting, model provider and client-side access are not all your responsibility.
• Never invent a certification: do not write that a certification or qualification is held if it is not.

What proof should you provide for each question?

Use the table as a starting grid. Questionnaires differ in wording, but the underlying questions repeat: what can the agent do, what stops it, who checked, and what happens when it fails. If a proof does not exist yet for one row, say so and give a date, rather than leaving the cell empty.

Which tests should you have run before answering?

At minimum, tests on the risks that come back in almost every questionnaire. The minimal set:

1. Direct and indirect prompt injection: payloads placed in user inputs, then in content the agent reads (web page, email, document, ticket).
2. Data leakage: system prompt extraction, mixing between two customers, overly chatty tool results.
3. Tool abuse: calling an out-of-scope action, altered parameters, tool chaining.
4. Actions without approval: which actions with effects go out without sign-off, and under which conditions.
5. Secrets and configuration: keys visible in the context, logs, replies.

Each test must produce a dated, reproducible result tied to a version. The details of the flaws to check first in a questionnaire are in our article on the 7 flaws to test first, centered on an HR SaaS but useful as a grid.

How do you prepare the file before answering?

Build the file once, then reuse it for every client. One evidence file per delivered agent avoids answering from memory under the pressure of a procurement deadline. Here is a simple outline:

• Architecture sheet of one page: model used, connected tools, data sources, approval flow.
• Rights table: for each tool, what it can read, write or delete, and with which token.
• Latest test report: date, agent version, scope, findings, status of each fix.
• Incident procedure: how to shut the agent off, who to notify, within what time.
• Subprocessor register: model provider, host, third-party tools, with processing regions.
• Change log: model, prompt and tool updates since the last test.

Update this file at every notable change to the agent. A report eight months old on a version that has since changed three times no longer answers the question being asked.

How do you present limits without losing the client?

Present them as a status report with an attached plan. A client prefers "three findings, two fixed, one in progress with a date" to an answer with no reservations, which they find hard to believe. Write each limit in three lines:

• Finding: what was observed, with the version tested.
• Impact: what an attacker could obtain.
• Measure and deadline: the fix or compensating control, and the date.

If the client requires an independent test, offer it before being forced into it. A third party that did not build the agent finds flaws the development team no longer sees.

What role can an independent test play?

It provides the item clients request most often: a report from a third party, with scope, method, findings and evidence. The Agent Red Team Express (€1,900, 5 days, start within 48 hours after the quote and authorization are signed) delivers this report for one agent; you can see what it looks like in the sample report. For several agents delivered to several clients, the Custom Red Team is quoted individually, with a white-label option for agencies.

Tests run on development or staging by default; production is targeted only at the end client's written request. CleanIssue does not claim a PASSI qualification: the report attests to a technical test and does not amount to a certification. To scope your case, the first step is a free 30-minute discovery call.

Further reading

• AI agencies: the white-label offer
• AI agent security
• OWASP LLM Top 10: the guide
• Our method