Strategy & Metrics (SM) - Endpoints Domain

HAIAMM Assessment Questionnaire v3.5

Generated from cells/SM-Endpoints-L*.cell.json. Do not edit by hand. Canonical model: HAIAMM-v3.5-Framing.md · Handbook: HAIAMM-v3.5-Handbook.md.

---

Practice: Strategy & Metrics (SM) Domain: Endpoints Business Function: Governance Purpose: Stand up endpoint AI assurance, inventory the AI reaching users on managed and unmanaged devices, and baseline the metrics that prove sideloaded and browser AI is shrinking. Scoring Model: Evidence + Outcome Metrics (see Scoring Methodology below)

---

Instructions

• Answer from current, implemented practice, not plans or aspirations.
• Each question has two components: Evidence (what you did) and Outcome Metrics (how well it worked).
• Levels are derived, never self-assigned. Record evidence and metric values; the level falls out of the scoring below.
• Silence is not a pass. A metric you cannot produce is left blank and counts as not met. Do not estimate.
• Answer progressively. Complete all Level 1 questions before Level 2.

Evidence grade

Record how each answer is known, not only what is claimed (v3.5 framing §6). A level claim is graded at its weakest field.

Grade	Meaning
E0	Asserted by a practitioner, unevidenced
E1	Asserted, with a link to a named artifact
E2	Emitted by a system as telemetry
E3	Machine-attested and independently checkable

---

Scoring Methodology

Tier	Score	Criteria
Fully Mature	1.0	Evidence complete + ≥3 outcome metrics meet targets
Implemented	0.67	Evidence complete + 2 outcome metrics meet targets
Partial	0.33	Evidence partially complete + <2 outcome metrics meet targets
Not Implemented	0.0	No substantive evidence of practice

Practice maturity level achieved = the highest level where all 3 questions score ≥ 0.67.

---

Maturity Level 1, Foundational

Objective: Stand up endpoint AI assurance, inventory the AI reaching users on managed and unmanaged devices, and baseline the metrics that prove sideloaded and browser AI is shrinking.

Question L1.1: Charter endpoint AI assurance jointly with IT

Q1.1: Is there a published endpoint AI assurance charter jointly sponsored by the CISO and the IT or Digital Workplace leader, naming all seven archetypes, decision rights over installation and revocation, and a sanctioned option per archetype so that prohibition is paired with provision?

Evidence Required:

• [ ] Publish a charter within the first 30 days sponsored by the CISO jointly with the IT or Digital Workplace leader, because in this domain the discovery data, the enforcement points and the user relationship all sit with IT, and a security-only program will be able to describe the problem without being able to act on it
• [ ] Name the seven in-scope archetypes, being AI assistant or copilot on a managed endpoint, browser-based AI tool or extension, chatbot and conversational interface, multi-modal AI interface, AI-augmented productivity feature inside SaaS, mobile AI app, and edge AI device
• [ ] Constitute the working group across Security, IT endpoint management, Identity, Data Governance, Privacy counsel and a representative of the user community
• [ ] Define decision rights over which AI capabilities may be installed or enabled on a managed endpoint, who approves an exception, who can revoke access, and how unmanaged-device access to corporate data through AI tools is governed
• [ ] Commit to a sanctioned option per archetype, because prohibition without provision reliably produces sideloading

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L1.2: Inventory endpoint AI and audit the browser

Q1.2: Does one endpoint AI inventory reconcile against endpoint management, identity provider catalogues, SaaS admin consoles and egress telemetry, with a browser extension audit covering at least 95% of managed endpoints monthly against a maintained AI-capable extension list?

Evidence Required:

• [ ] Build one endpoint AI inventory recording per capability the archetype, the sanctioning status, the population with access, the data classes reachable through it, whether it is available on unmanaged devices, the identity and authentication path, seat count and utilisation, and links to the vendor inventory record where the capability is vendor-supplied
• [ ] Seed from endpoint management and mobile device management, the identity provider application catalogue, and SaaS admin consoles
• [ ] Then run the domain's highest-yield discovery mechanism: a browser extension audit across managed endpoints, enumerating installed extensions against a maintained list of AI-capable ones, because browser-resident AI installs without administrative rights, leaves no conventional software inventory footprint, and can read the contents of every page the user opens, including internal applications
• [ ] Complement it with egress analysis to AI provider domains segmented by device management status, which is the only practical way to size the unmanaged-device exposure that the other signals cannot see

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L1.3: Baseline the endpoint scoreboard and open the per-user ledger

Q1.3: Is unmanaged-device AI exposure to corporate data quantified with a documented method, and is a per-user ledger open recording seat cost and consumption per active user with utilisation reported as both a waste and an exposure measure?

Evidence Required:

• [ ] Instrument and report quarterly: endpoint AI inventory coverage, the share of managed endpoints carrying only sanctioned AI capabilities, browser extension audit coverage and the count of unsanctioned AI-capable extensions in use, acceptable-use attestation across the workforce, estimated unmanaged-device AI exposure to corporate data, and known data-exposure events through endpoint AI. Open the per-user ledger recording AI consumption and seat cost per active user, with utilisation tracked beside cost
• [ ] Seat utilisation carries double meaning in this domain and should be reported as both: an unused seat is wasted spend, and it is also a standing authenticated path from an identity to a vendor holding corporate data, which is exposure that persists precisely because nobody is looking at an unused account
• [ ] Where seat and utilisation data sits with IT rather than security, record the dependency explicitly rather than estimating around it

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 1 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
Endpoint AI inventory coverage against endpoint-management, identity and egress discovery	___	___	≥85% within 12 months	☐
Managed endpoints carrying only sanctioned AI capabilities	___	___	≥90% of managed endpoints	☐
Browser extension audit coverage across managed endpoints	___	___	≥95% of managed endpoints audited at least monthly	☐
Unsanctioned AI-capable browser extensions in use	___	___	0 with access to internal applications, and falling overall	☐
Workforce with an acknowledged AI Acceptable Use Policy covering endpoint AI	___	___	≥95% of workforce	☐

Where each number is read from:

• Endpoint AI inventory coverage against endpoint-management, identity and egress discovery — Inventory reconciled against MDM, IdP catalogue and egress telemetry; where endpoints are unmanaged, a sampled survey with its coverage stated, recorded at E1
• Managed endpoints carrying only sanctioned AI capabilities — Endpoint management inventory joined to the sanctioned-capability list; where endpoints are unmanaged, a sampled survey with its coverage stated, recorded at E1
• Browser extension audit coverage across managed endpoints — Browser extension inventory from endpoint management; where endpoints are unmanaged, a sampled survey with its coverage stated, recorded at E1
• Unsanctioned AI-capable browser extensions in use — Extension inventory cross-referenced with the AI-capable extension list
• Workforce with an acknowledged AI Acceptable Use Policy covering endpoint AI — HR / LMS attestation records

Level 1 Consumption Metrics

Absolute spend is a ledger input, never a metric. Every row is divided by a unit of business work. If AI spend is not allocated to an owning team, record this level as blocked on allocation rather than scoring it down (v3.5 framing §12).

Metric	Denominator	Current	Economic failure it detects	Met?
AI consumption and seat cost per active user, by archetype	per active user	___	licence waste, where seats are provisioned and never used, which is simultaneously wasted spend and a standing authenticated path to a vendor holding corporate data	☐
AI consumption per assisted action, by archetype	per assisted action	___	runaway per-user consumption from automation or abuse of a per-seat tool, which flat per-seat pricing hides until the vendor renegotiates	☐
Share of endpoint AI consumption attributable to a managed identity on a managed device	per dollar of endpoint AI consumption	___	AI consumption originating from unmanaged devices or shared accounts, where neither the data reaching the tool nor the person using it can be established	☐

Level 1 30-second check (E0)

• ☐ Yes ☐ No — Do you know which AI browser extensions your staff have installed?
• ☐ Yes ☐ No — Is there a sanctioned AI assistant people can use without asking?
• ☐ Yes ☐ No — Are you paying for AI seats that nobody signed into this month?

---

Maturity Level 2, Comprehensive

Objective: Tier endpoint AI by data reach and device posture, calibrate control intensity per tier, and bound per-user consumption on customer-facing and high-reach interfaces.

Prerequisite cells: SM-Endpoints-L1, PC-Endpoints-L1, TA-Endpoints-L1

Question L2.1: Publish the endpoint AI risk-tier rubric

Q2.1: Is every endpoint AI capability assigned a tier from a published rubric covering data reach, exposed population, device management posture, customer-facing exposure and untrusted-content exposure, re-derived when data reach or device posture changes?

Evidence Required:

• [ ] Derive four tiers from five auditable dimensions
• [ ] Data reach is the floor: a capability that can read regulated or customer-confidential content, including a browser extension with access to internal application pages, sits at Critical or High regardless of how it was acquired
• [ ] Exposed population elevates with the number of users and the breadth of their access, since a capability available to everyone inherits the union of everyone's reach
• [ ] Device management posture elevates where the capability is reachable from unmanaged devices, because neither the endpoint state nor the data leaving it can be established there
• [ ] Customer-facing exposure elevates to Critical for conversational and multi-modal interfaces reachable by the public, which combine untrusted input with an organizational voice
• [ ] Untrusted-content exposure elevates where the capability processes content the organization does not control, which is the precondition for prompt injection to become action
• [ ] Publish the rubric and re-derive when data reach or device posture changes

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L2.2: Calibrate endpoint controls and consumption limits per tier

Q2.2: Does the tier-treatment matrix cover allowlisting enforcement, authentication, device compliance prerequisites, input data-loss prevention, logging completeness, content filtering and testing, with 100% of Critical-tier capabilities under enforced rather than advisory allowlisting?

Evidence Required:

• [ ] Publish a tier-treatment matrix covering per tier: extension and application allowlisting from advisory to enforced blocking
• [ ] Authentication strength and session policy
• [ ] Device compliance prerequisites including whether unmanaged access is permitted at all
• [ ] Data-loss prevention on input to the AI capability, which is the control most often omitted because it is harder than egress DLP
• [ ] Logging completeness including whether prompts and responses are captured and for how long
• [ ] Content filtering and output handling
• [ ] Testing obligations including prompt-injection batteries for anything processing untrusted content
• [ ] Add the consumption row: customer-facing conversational and multi-modal interfaces carry per-user and per-session request and token limits with a declared behaviour at the limit, and per-user daily budgets for high-tier assistant capabilities
• [ ] A public conversational interface is the cheapest denial-of-wallet target an organization operates, because the attacker needs no credentials and the abuse is indistinguishable from popularity until the invoice arrives

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L2.3: Report per tier and govern unmanaged-device exposure

Q2.3: Do all customer-facing conversational interfaces carry per-user and per-session limits with tested at-limit behaviour, and is there a sponsor-signed quarterly position recording whether unmanaged-device access to each Critical-tier capability is blocked, conditionally permitted or accepted?

Evidence Required:

• [ ] Report the scoreboard per tier and archetype quarterly covering inventory and tier state, allowlisting enforcement conformance, extension audit results per tier, per-tier logging completeness, consumption-limit conformance on customer-facing interfaces, seat utilisation per tier, and the Assured Spend Ratio for endpoint AI consumption
• [ ] Produce an explicit unmanaged-device position, refreshed quarterly and signed by the sponsor, recording for each Critical- and High-tier capability whether unmanaged access is blocked, conditionally permitted with named compensating controls, or accepted as a risk with a named owner and a review date
• [ ] This is the dimension most often left undecided in this domain, because blocking it is unpopular and permitting it is uncomfortable, so it persists as an unexamined default
• [ ] Maintain a tier-movement log recording the triggering dimension and review it quarterly

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 2 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
Endpoint AI capabilities carrying a current tier assignment	___	___	100% of inventoried capabilities, with tier age under 12 months	☐
Critical- and High-tier capabilities under enforced allowlisting rather than advisory policy	___	___	100% of Critical, ≥90% of High	☐
Customer-facing conversational interfaces with per-user and per-session limits and tested at-limit behaviour	___	___	100%	☐
Critical-tier capabilities reachable from unmanaged devices without a signed acceptance	___	___	0	☐
Per-tier logging completeness against the tier's declared baseline	___	___	≥95% at Critical and High	☐
Seat utilisation at Critical and High tier	___	___	≥80% of provisioned seats active in the last 30 days	☐

Where each number is read from:

• Endpoint AI capabilities carrying a current tier assignment — Endpoint AI inventory tier field
• Critical- and High-tier capabilities under enforced allowlisting rather than advisory policy — Endpoint management allowlist enforcement configuration; where endpoints are unmanaged, a sampled survey with its coverage stated, recorded at E1
• Customer-facing conversational interfaces with per-user and per-session limits and tested at-limit behaviour — Gateway limit configuration reconciled against inventory tier; where no AI gateway is deployed, provider-side usage and limit configuration read per provider account, recorded at E1
• Critical-tier capabilities reachable from unmanaged devices without a signed acceptance — Device posture policy joined to the unmanaged-device position statement
• Per-tier logging completeness against the tier's declared baseline — Logging configuration audit joined to inventory tier
• Seat utilisation at Critical and High tier — SaaS management platform joined to identity provider activity; where none is in use, expense records reconciled against identity grants, recorded at E1

Level 2 Consumption Metrics

Absolute spend is a ledger input, never a metric. Every row is divided by a unit of business work. If AI spend is not allocated to an owning team, record this level as blocked on allocation rather than scoring it down (v3.5 framing §12).

Metric	Denominator	Current	Economic failure it detects	Met?
Consumption per active user at Critical and High tier against the tier's expected range	per active user	___	automation or credential sharing behind a per-seat tool, where one identity consumes at a rate no human could, which flat per-seat pricing conceals until renewal	☐
Consumption per session on customer-facing conversational interfaces	per session	___	denial-of-wallet against a public interface, where the attacker needs no credentials and the traffic is indistinguishable from popularity until the invoice arrives	☐
Per-user limit breach rate and at-limit behaviour conformance	per interface-quarter	___	limits configured but silently continuing past the cap, which provides the appearance of a control with none of its effect	☐
Seat cost per active user at Critical tier, with utilisation	per active user	___	unused high-tier seats persisting as both waste and standing authenticated access to the capabilities with the broadest data reach	☐

Level 2 30-second check (E0)

• ☐ Yes ☐ No — Does every endpoint AI capability carry a risk tier?
• ☐ Yes ☐ No — Is your AI extension policy enforced, or is it advice?
• ☐ Yes ☐ No — Can one user run up an unlimited bill on your public chatbot?

---

Maturity Level 3, Industry-Leading

Objective: Drive endpoint AI discovery and tiering from continuous device and identity telemetry, benchmark per-user economics and exposure, and contribute endpoint AI assurance patterns back.

Prerequisite cells: SM-Endpoints-L2, ML-Endpoints-L2, EG-Endpoints-L2

Question L3.1: Make endpoint AI discovery continuous

Q3.1: Is endpoint AI discovery continuous across extension install and permission-change events, identity first-authentication events, SaaS admin change feeds and gateway telemetry, with install-to-inventory latency at or below 24 hours at the 90th percentile and at least 80% auto-curation?

Evidence Required:

• [ ] Replace periodic audits with streaming telemetry
• [ ] Stream browser extension install and permission-change events from endpoint management, so an AI-capable extension acquiring read access to all sites raises an event rather than waiting for the monthly sweep
• [ ] Stream identity-provider first-authentication events against AI services
• [ ] Stream SaaS admin API change feeds for newly enabled AI features inside approved products
• [ ] And stream endpoint AI gateway telemetry for previously unseen destinations
• [ ] Wire tier derivation to re-run on data-reach and device-posture change and to open downstream obligations on tier increase
• [ ] Publish a data-quality objective covering time from install or enablement to inventory record, targeting 24 hours, which is achievable here because the telemetry is event-driven rather than reconciliation-driven and necessary because a browser extension can read every page a user opens from the moment it is installed
• [ ] Reserve human curation for capabilities on unmanaged devices, shared or service accounts, and genuinely novel archetypes

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L3.2: Benchmark per-user economics and endpoint AI exposure

Q3.2: Does the semi-annual benchmarking brief report unsanctioned extension prevalence per thousand managed endpoints and cost per active user by archetype against a named peer cohort of comparable size and sector, with the selection defended?

Evidence Required:

• [ ] Publish a semi-annual brief comparing the program against peers of comparable size and sector on at least five metrics: endpoint AI inventory coverage and discovery latency, unsanctioned extension prevalence per thousand endpoints, seat utilisation by archetype, cost per active user by archetype, and unmanaged-device exposure share
• [ ] Prevalence per thousand endpoints is the comparison that matters most and is rarely available, because it normalises for organization size and reveals whether an unsanctioned-extension count is a local failure or an industry baseline
• [ ] An organization discovering forty unsanctioned AI extensions does not know whether that is alarming without knowing what comparable organizations find
• [ ] Draw from peer security communities, sector information-sharing bodies, endpoint-management vendor user groups and the FinOps Foundation SaaS scope
• [ ] Name the cohort, defend its selection, and publish where the program trails

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L3.3: Contribute extension-risk intelligence and compute the endpoint return

Q3.3: Does the program contribute at least four externally accepted artifacts per year weighted toward shared AI-capable extension risk classifications, and is the endpoint return computed from per-user ledger arithmetic covering reclaimed waste, contained abuse and avoided exposure?

Evidence Required:

• [ ] Contribute at least four substantive artifacts per year, weighted toward the shared-maintenance problem: AI-capable browser extension risk classifications contributed to community lists, since no single organization can maintain this well alone and every organization currently tries
• [ ] Endpoint AI hardening baselines and allowlist configurations published in a form peers can apply
• [ ] Observed endpoint-layer techniques such as extension permission escalation and SaaS AI feature enablement without notification submitted to community advisories and MITRE ATLAS where they fit
• [ ] And OWASP LLM working-group input on the endpoint attack surface
• [ ] Count only externally accepted artifacts
• [ ] Compute the endpoint-domain return from the per-user ledger: reclaimed licence waste from deprovisioned unused seats, which is usually the dominant component
• [ ] Contained per-user abuse and denial-of-wallet on customer-facing interfaces
• [ ] And avoided exposure cost from extensions blocked before they gained access to internal applications, valued by the data reach they would have had
• [ ] Reconcile with Finance and IT annually

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 3 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
Time from extension install or SaaS AI feature enablement to an inventory record	___	___	≤24 hours at the 90th percentile	☐
Endpoint AI inventory entries created without human curation	___	___	≥80% auto-curated	☐
Unsanctioned AI-capable extension prevalence per thousand managed endpoints	___	___	at or below the peer cohort median, and falling	☐
Peer-comparable metrics in the semi-annual brief	___	___	≥5 metrics with a named and defended peer cohort	☐
Externally accepted endpoint AI assurance contributions per year	___	___	≥4 accepted, weighted toward shared extension-risk classifications	☐

Where each number is read from:

• Time from extension install or SaaS AI feature enablement to an inventory record — Endpoint and identity telemetry event pipeline
• Endpoint AI inventory entries created without human curation — Curation telemetry from the discovery pipeline
• Unsanctioned AI-capable extension prevalence per thousand managed endpoints — Extension telemetry normalised against managed endpoint count
• Peer-comparable metrics in the semi-annual brief — Published benchmarking brief
• Externally accepted endpoint AI assurance contributions per year — Contribution log with external acceptance references

Level 3 Consumption Metrics

Absolute spend is a ledger input, never a metric. Every row is divided by a unit of business work. If AI spend is not allocated to an owning team, record this level as blocked on allocation rather than scoring it down (v3.5 framing §12).

Metric	Denominator	Current	Economic failure it detects	Met?
Cost per active user by archetype, benchmarked against peers of comparable size and sector	per active user	___	an endpoint AI footprint that is unusual for the organization's size and sector in either direction, which raw internal figures cannot reveal	☐
Reclaimed licence waste from deprovisioned unused seats	per active seat recovered	___	seats accumulating through joiner-mover-leaver drift, carrying standing authenticated access to vendors holding corporate data	☐
Contained per-user and per-session abuse value on customer-facing interfaces	per contained event	___	denial-of-wallet against a public interface running long because the traffic looks like adoption, where time to detect is the whole of the loss	☐

Level 3 30-second check (E0)

• ☐ Yes ☐ No — Would a new AI browser extension show up in your inventory today?
• ☐ Yes ☐ No — Do you know how your unsanctioned extension count compares per thousand endpoints?
• ☐ Yes ☐ No — Have you contributed an AI extension risk classification to a community list?

---

Summary Scorecard

Level	Q1	Q2	Q3	Level score	Weakest evidence grade	Achieved?
L1	___	___	___	___	___	☐
L2	___	___	___	___	___	☐
L3	___	___	___	___	___	☐

Strategy & Metrics (SM) maturity in the Endpoints domain: ____________

---

Document Version: HAIAMM v3.5 (generated)