Free tool · no signup · about 6 minutes
Agentic Attack Readiness Scorecard
Attackers are now giving AI agent frameworks a stolen credential and letting them run. 23 questions tell you how far that would get in your environment, which gaps to close first, and what to tell the board.
Why it exists: on 30 October 2026, Google Threat Intelligence Group and Mandiant reported threat actors using ARTEX, PentAGI and similar frameworks in real intrusions, working in bursts of roughly 2 to 25 seconds. The questions follow Mandiant's five defensive layers from that report. Read our summary of what GTIG found.
1. Control-plane isolation
0/3Admin APIs, consoles, CI/CD and app management interfaces (such as Azure Kudu/SCM) were used as footholds. A reachable admin path is one more thing an agent can test.
Are cloud admin APIs, consoles, CI/CD, hypervisor, backup and firewall management reachable only from trusted networks or private connectivity?
Are application management and publishing endpoints (for example Azure App Service Kudu/SCM) treated as privileged: network-restricted, with basic publishing authentication disabled?
Do privileged users administer from managed devices or jump hosts with phishing-resistant MFA (FIDO2 or passkeys)?
2. Short-lived credentials
0/3Attackers handed ARTEX compromised credentials and let it run. A long-lived key that works from anywhere turns one leak into broad access within minutes.
Have static cloud keys and client secrets been replaced with short-lived, workload-bound credentials (IAM roles, Managed Identities, Workload Identity Federation, OIDC)?
Can non-human identities authenticate only from the networks and workloads they are meant to run on?
Do you continuously scan repos, images, pipelines and configs for secrets, and rotate exposed ones promptly?
3. Least privilege
0/4ARTEX used what valid accounts were allowed to do: a database API that could write files, a writable admin flag, a notification feature that reached over 1,300 users.
Does every service principal, service account and API key have an owner, a documented purpose and only the permissions it needs?
Are application database accounts unable to write arbitrary files, change server-wide settings or run operating-system commands?
Do high-impact business functions (bulk email or notifications, user creation, access changes, data export) have rate and recipient limits?
Are password vaults and secret stores behind tightly controlled paths, with alerts on bulk queries or exports?
4. Segmentation and egress
0/3Agents moved from an exposed server towards domain controllers and sent results out through 491 rotating webhook.site URLs. Segmentation and egress control slow both.
Are internet-facing servers blocked from opening Kerberos, NTLM, LDAP, SMB, WinRM, RDP or database connections to internal systems they do not need?
Is outbound internet from production servers restricted, with webhook, OAST, tunnelling and file-sharing services blocked or alerted?
Have you hardened AD CS templates and enforced SMB signing, LDAP signing and channel binding, with NTLM reduced?
5. Behavioural detection
0/4Much agentic activity uses valid identities and normal APIs, so static indicators miss it. The signal is origin, volume, timing and sequence compared with a baseline.
Do you have a baseline for sensitive service principals and admin identities: usual sources, APIs, resources and volumes?
Do you alert when a privileged or workload identity authenticates from a new network, ASN, cloud region or hosting provider?
Do detections correlate sequences across identity, control-plane, data-plane, endpoint and network logs?
Do you keep enough identity, control-plane, storage data-plane, DNS, proxy and flow logs to establish what normal looks like?
6. Detect machine-speed activity
0/3ARTEX worked in bursts of roughly 2 to 25 seconds, such as 27 events in 23 seconds of AWS permission probing. Rules tuned to human pacing will not fire.
Would you alert on a burst of dozens of management API calls or permission checks (dry-run calls, caller-identity checks) within seconds?
Would you notice sudden object enumeration, mass blob reads or write-then-delete test objects in sensitive storage?
Would you catch a burst of new accounts, password resets or admin grants made within minutes?
7. Response speed
0/3One campaign went from first compromised account to deep access in about four hours, once in 15 minutes. Detection only helps if someone can contain at that pace.
Can on-call staff disable an identity, revoke its tokens and cut a server off the network within 15 minutes, out of hours, without waiting for approval?
Do you know, before an incident, which platforms provide remote command execution, deployment, bulk messaging, certificate issuance or identity sync?
Have you exercised a scenario where the attacker moves from a stolen credential to deep access in under an hour?
Answer all 23 questions to see your scores, the prioritised gap list and a board summary. 23 to go.
What changed, in one line
Mandiant's point is that the techniques are not new: credential discovery, permission testing, lateral movement and data access. What changed is the time it takes to chain them, from hours of operator effort to minutes. Controls that limit what a valid identity can do, plus telemetry that shows when it behaves unusually, are what reduce that speed advantage.
A self-assessment for planning, not an audit or a benchmark. PlayCISO is not affiliated with Google or Mandiant.
Questions
What is the Agentic Attack Readiness Scorecard?
A free self-assessment of how ready your organisation is for AI-driven, machine-speed intrusions. You answer 23 yes, partly or no questions grouped under Mandiant's five defensive layers plus detection speed and response speed. You get a 0 to 100 score per area and overall, a prioritised list of gaps with plain-English fixes, and a one-paragraph summary to paste into a board paper.
Why does this scorecard exist?
On 30 October 2026 Google Threat Intelligence Group (GTIG) and Mandiant reported threat actors running agentic offensive frameworks such as ARTEX and PentAGI in real intrusions. The tools did not use new techniques. They chained old weaknesses, such as stolen credentials, exposed admin interfaces and over-privileged accounts, at machine speed. The scorecard checks the controls Mandiant recommends against that.
What are the five control areas?
Mandiant lists five layers: protect control planes, restrict identities and keys (short-lived credentials), harden configurations (segmentation and least privilege), harden application functionality, and detect behavioural change. The scorecard groups them as control-plane isolation, short-lived credentials, least privilege, segmentation and egress, and behavioural detection, and adds two areas of its own: detecting machine-speed activity and response speed.
How is the score calculated?
Yes counts 1, partly 0.5 and no 0. Questions that close a path GTIG saw abused in the reported intrusions carry three times the weight of general hygiene questions. Each area is scored 0 to 100, and the overall score is the average of the seven areas so each one counts equally.
Is my data sent anywhere?
No. The scorecard runs in your browser. Your answers are not stored or uploaded. If you have accepted analytics cookies, only an anonymous event that the scorecard was completed, with the overall score, is recorded.
Is this an audit or a benchmark?
No. It is a self-assessment for planning. The questions paraphrase Mandiant's published guidance; the weights and the two extra areas are PlayCISO's. Use it to decide what to fix first, then verify the important answers with evidence.
Keep going
- Human or Agent Lab: tell an AI agent from a human operator in the logs.
- Time to Domain Admin: see how fast a stolen credential becomes domain access.
- Kudu hardening checklist: lock down Azure App Service management endpoints.
- Request-bin egress checker: find servers that can reach webhook and OAST services.
- Agent egress containment lab: practise cutting off an agent's outbound paths.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.