AI Threat → Control → Test Traceability Matrix
Show, threat by threat, how each AI system is protected and how you know. Pick your AI systems and the ISO/IEC 27090 threat themes that apply, map the controls for each threat, then the tests and their evidence status. The matrix flags every threat with no control and every control with no test, and the heat view shows all systems against all themes at once.
Free, in your browser, nothing uploaded. Designing the tests? Use the AI Security Test Plan (Pro).
Saved in this browser only. Nothing is uploaded.
1. AI systems and threat themes
Name each AI system, then tap the threat themes that apply to it.
Coverage
Heat view
Systems down, threat themes across. Tap a cell to jump to it, or to add that theme.
| AI system | Prompt inj. | Poisoning | Evasion | Extraction | Inversion | Membership | Supply chain | Output | Agency | Resource | Leakage |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Customer-support RAG assistant | |||||||||||
| Fraud-scoring model |
Coverage gaps (6)
Missing controls and failed tests first, then untested controls, tests not run and missing evidence.
- Customer-support RAG assistant · Insecure output handling — Threat in scope with no control mapped to it.
- Fraud-scoring model · Evasion and adversarial examples · Adversarial robustness check in the release gate · Perturbed transaction set within error budget — Test failed: the control does not yet address the threat.
- Customer-support RAG assistant · Sensitive data leakage · Output filter for personal data — Control has no test, so there is no evidence it works.
- Customer-support RAG assistant · Prompt injection (direct and indirect) · Ticket-update tool requires agent approval · Injected instruction attempts to close tickets — Test planned but not run.
- Customer-support RAG assistant · Prompt injection (direct and indirect) · Ticket-update tool requires agent approval · Injected instruction attempts to close tickets — No evidence filed for this test.
- Fraud-scoring model · Evasion and adversarial examples · Adversarial robustness check in the release gate · Perturbed transaction set within error budget — Evidence is incomplete.
2. Map controls, then tests and evidence
For each threat, add the controls that address it, then the tests that prove each control works and where the evidence is.
Customer-support RAG assistant
No test yet: this control is unproven.
No control mapped: this threat is uncovered.
Fraud-scoring model
3. Export
CSV has one row per test (or per uncovered threat and untested control). Markdown adds the summary, heat view and gap list.
TL;DRWhat this matrix does
4 points
- A traceability matrix links each AI threat to the controls that address it and to the tests that prove those controls work, with the evidence status of each test.
- Pick your AI systems and the ISO/IEC 27090 threat themes that apply: prompt injection, poisoning, evasion, extraction, inversion, membership inference, supply chain, output handling, excessive agency, resource abuse and data leakage.
- The tool flags the two gaps an auditor looks for first: a threat with no control, and a control with no test. Failed tests, tests not run and missing evidence are listed too.
- A heat view shows every system against every theme on one screen. Export to CSV or Markdown. Free, runs in your browser, nothing uploaded.
Why trace threats to tests
A risk register says which AI threats you worry about. A control list says what you have built. Neither shows that a control actually addresses a named threat, or that anyone has checked it works. Traceability joins the three, so a reviewer can pick any threat, follow it to a control, and see a test result and an evidence reference.
The gaps are where the work is. A threat with no control is an accepted risk nobody accepted. A control with no test is an assumption. A failed test is a finding with an owner. ISO/IEC 27090 is guidance rather than a certifiable standard, so this matrix is how you demonstrate that you have used it, inside the ISO/IEC 42001 or 27001 management system you already run.
Frequently asked questions
What is an AI threat traceability matrix?
It is a table that follows each AI-specific threat through to the controls that address it, then to the tests that show each control works and the evidence those tests produced. Reading along a row answers "how do we know this threat is handled?" Reading for empty cells shows where the answer is "we don't".
Which threat themes does it use?
The AI-specific threat areas that ISO/IEC 27090 addresses, described in our own words and cross-referenced to public catalogues such as the OWASP LLM Top 10, OWASP Machine Learning Security Top 10 and NIST AI 100-2. They are the same themes used in the PlayCISO 27090 Threat Mapping Lab and AI Security Test Plan. No clause numbers are given, because the tool does not reproduce the standard.
What counts as a coverage gap?
A threat in scope with no control, a control with no test, a failed test, a test that has not been run, and a test with missing or partial evidence. A threat is only shown as traced and evidenced when every control has at least one test, every test has passed (with or without findings) and evidence is filed.
Does a complete matrix mean we are ISO/IEC 27090 certified?
No. ISO/IEC 27090 is guidance and there is no certification against it. The matrix is evidence that you have taken up the guidance and can show it working. Certification is available for an AI management system under ISO/IEC 42001 and an information security management system under ISO/IEC 27001, and this matrix is useful supporting evidence for either.
Where is my data stored?
Only in your browser's local storage, so it is still there when you come back on the same device. Nothing is sent to PlayCISO. Export to CSV or Markdown to keep a copy or share it.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.