Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

Self-assessment · 13 questions · about 4 minutes

How exposed are you to the next CVE, and to your own coding agents?

For team leads and CTOs of teams from 10 to 200 people. Answer for how things really work today: lockfiles, alerts, fixes, and what your agents can install, call and reach.

  • A score and a stage Out of 100, across 5 pillars, from tracking dependencies to what your coding agents can reach.
  • Your top three gaps The answers that cost you most, why each matters, and what to do about it. Most fixes are habits, not tools.
  • Nothing stored No sign-up and no form. Your answers live in the result’s link, so you can share it, or email it to yourself.

Start the assessment

13 questions in 5 pillars. Choose one answer for each; “Not sure” is always an option.

Pillar 1 of 5 Know what you run

Every dependency in every app, pinned and listed, so a CVE can be checked against it.

Question 1 of 13 Are your lockfiles committed, and do they match what you ship?

A lockfile pins every package, direct and transitive. Without one, nobody can say which versions are installed.

Question 2 of 13 Could you list every dependency across all your apps today?

Every repository, service and script that ships, including the ones nobody has touched in a year.

Pillar 2 of 5 Separate signal from noise

Telling which alerts affect you, acting on what attackers use, and writing down why.

Question 3 of 13 When a dependency alert arrives, how do you decide whether it matters?

Dependabot, npm audit and similar tools flag versions. Most flagged versions can’t be reached from your code.

Question 4 of 13 When you decide an alert doesn’t apply, do you write down why?

A dismissed alert with no reason looks the same as one nobody read.

Question 5 of 13 Do actively exploited issues jump the queue?

CISA’s KEV catalogue lists CVEs that attackers are known to be using.

Pillar 3 of 5 Fix fast, safely

Getting real fixes into production quickly, transitive ones included, without merging blind.

Question 6 of 13 When a critical issue really affects you, how long until the fix is in production?

From the moment you know to the moment it’s deployed.

Question 7 of 13 How are dependency bump PRs from bots and coding agents reviewed?

Dependabot, Renovate and coding agents open upgrade PRs. Who checks them, and how?

Question 8 of 13 When the issue is in a transitive dependency, can you fix it?

Most of what you install is a dependency of a dependency. Its fix often waits on someone else.

Pillar 4 of 5 Guard your coding agents

What your agents can install, which tools they can call, and what their credentials can reach.

Question 9 of 13 Can your coding agents add new packages without anyone checking?

Agents add dependencies to solve problems. A name that looks right can be brand new, a look-alike, or malicious.

Question 10 of 13 Which MCP servers and tools can your agents use, and who decides?

Every MCP server or tool you connect can read what the agent reads, and act with its access.

Question 11 of 13 What credentials can your coding agents use?

Tokens in the environment, cloud keys, SSH keys, a signed-in CLI: whatever the agent’s shell can reach.

Pillar 5 of 5 Respond when it’s real

Answering “are we affected?” within the hour, and showing customers how you handle it.

Question 12 of 13 When a big CVE breaks, could you say within an hour whether you’re affected?

The next one like Log4Shell lands on a Friday afternoon, and someone asks: are we affected?

Question 13 of 13 When a customer or auditor asks how you handle dependency risk, what can you show them?

Security questionnaires, SOC 2 and enterprise deals all ask.

How the score works

Five pillars, averaged.

Each answer scores 100, 67, 33 or 0, best first. “Not sure” scores 0: not knowing is a gap too. A pillar’s score is the average of its answers, and your score is the average of the five pillars, so each pillar counts the same.

  • Exposed, 0 to 39: The next big CVE would likely find you before you found it.
  • Reactive, 40 to 64: You deal with issues as they reach you, but a lot rests on who’s around.
  • Managed, 65 to 84: The basics are in place, and you have a real process.
  • Ahead, 85 to 100: You know what you run, act on what matters, and keep your agents in check.

Your top three gaps are your lowest-scoring answers. Where agentprime helps with one, we say so and link to it; most of them are good practice you can start today without us.

It’s a self-assessment from your own answers: a starting point, not an audit, and a high score doesn’t mean you’re safe. We don’t store your answers or count who took it.