Application & DevSecAIOps Security

L1 · Initial

Models deployed without security or safety review regardless of deployment type. For self-hosted models, no integrity controls or restrictions on unsafe file formats. For PaaS/API models, default configurations used without security assessment. No evaluation of third-party or open models before use. Model provider security posture not assessed.

L2 · Repeatable

Basic security requirements documented for model deployments (e.g., system prompt requirements). Third-party and open models undergo risk review for major deployments, including basic safety evaluation. For self-hosted models, unsafe file formats recognized but enforcement inconsistent. For PaaS/API models, initial configuration reviews performed. Model provider security assessments conducted for primary providers.

L3 · Defined

Standardized security and safety (bias/harm/hallucination) requirements for models based on deployment type and risk classification. Self-hosted models require integrity verification and secure file formats. PaaS/API model configurations hardened per documented standards. Formal risk assessment process for third-party and open models. Model versioning and rollback capability established. Initial monitoring for model behavior and performance in production.

L4 · Capable

Model signing and provenance verification enforced for self-hosted models. Automated configuration validation for PaaS/API deployments. Adversarial robustness testing standard for production use cases. Continuous monitoring for model drift, degradation, safety, and anomalous behavior across deployment types. Model risk metrics tracked and reported through governance processes.

L5 · Efficient

Automated model security verification across deployment types integrated into pipelines. Real-time monitoring with automated alerting on drift, safety issues, or anomalies. Adversarial testing integrated into CI/CD with defined thresholds. Proactive updates to model security controls as providers release changes or new attack vectors emerge.