AIZA-Hextyx provides automated AI security assessment tools. The following limitations apply to all scan results, reports, and findings generated by the platform.
A scan that returns zero findings does not mean a system is secure.
AIZA's scan engine tests for a defined set of vulnerability categories using measurement-based methodologies. Every security assessment is:
Point-in-time: Results reflect the state of the tested system at the moment of scanning. AI systems change continuously — new model versions, updated system prompts, changed tool configurations, and new data may introduce vulnerabilities not present at the time of the previous scan.
Bounded by methodology: AIZA tests 23 specific vulnerability categories. Novel attack techniques, zero-day vulnerabilities, and attack vectors outside AIZA's current methodology will not be detected.
Dependent on target configuration: AIZA tests the endpoint you provide. If your AI system behaves differently in production than at the tested endpoint, production vulnerabilities may not be reflected in results.
AIZA is a software tool, not a security consulting firm. The remediation guidance included in scan reports is:
For critical vulnerabilities, particularly those rated CRITICAL or HIGH, we strongly recommend engaging a qualified AI security professional to review the findings and advise on remediation in your specific context.
AIZA reports reference OWASP, MITRE ATLAS/ATT&CK, CWE, and other security frameworks. These references are provided for context and to facilitate communication with security teams. They are not:
Compliance determinations require qualified legal and compliance professionals with knowledge of your specific regulatory context.
AIZA's detection methodology is designed to minimise false positives. However:
False positives may occur: A finding may be reported in circumstances where the tested system is not actually vulnerable. Human review of findings is recommended before taking action.
False negatives will occur: Some vulnerabilities will not be detected. No automated tool has 100% detection capability.
Results are probabilistic: Confidence scores represent AIZA's assessment of the likelihood that a finding is genuine, not a certainty.
AIZA is not liable for:
These limitations are described more fully in our Terms of Service.
References to MITRE ATLAS, MITRE ATT&CK, OWASP, CWE, NIST, and other third-party frameworks are for informational purposes. These frameworks are maintained by independent organisations. AIZA makes no representation that its mapping to these frameworks is official, endorsed by, or affiliated with those organisations.
This platform may only be used to assess AI systems for which you have explicit written authorization. Using AIZA against systems without authorization may violate computer crime laws in your jurisdiction. See our Acceptable Use Policy.
Questions about this disclaimer: legal@hextyx.com