Securaity is now live. It is a free, independent site that tracks security and safety problems in AI software and services, rates how serious each one is, and tells you in plain language who is affected and what to do. If your organization uses AI tools, or is deciding whether to, this site is meant to help you make that call with facts in front of you.
What Securaity is and why it exists
More small organizations are using AI tools, often without someone whose full-time job is security. Vulnerability records are public, but they are written for specialists and spread across several databases. Tool privacy policies are long and change without much notice.
Securaity pulls that information together and writes it up for the people who have to decide. Our first audience is non-profits and small organizations. We also write for IT staff at small organizations, developers running open-source AI software, and governance and compliance staff.
Securaity is an independent site. It has no sponsors, no advertising and no paid listings. Every page is free to read, and you do not need to sign up for anything.
What you will find
Advisories
An advisory is one dated record for one vulnerability in one product. Each advisory gives a severity rating and the source description. For Critical and High advisories, we add a short “who is affected” and “what to do” analysis. You can browse them newest first on the advisories page. We check for new advisories daily.
Severity follows the published CVSS score:
| Severity | CVSS score |
|---|---|
| Critical | 9.0 and above |
| High | 7.0 to 8.9 |
| Medium | 4.0 to 6.9 |
| Low | Above 0 and below 4.0 |
| Info | No score published |
Product pages and feeds
At launch we track 30 AI products. Each one has its own vulnerability page, listed on the vulnerabilities page, and each product page has its own RSS feed. Securaity has no newsletter. If you want to hear about new advisories, follow the feed for each product you use.
Tool safety profiles
The tool profiles cover everyday AI tools. Each profile explains:
- what the tool does with your data
- how to opt out of having your data used for training
- how long data is kept
- what admin controls exist
- which certifications the vendor lists
- where data is stored
- how the free and paid tiers differ
- a verdict for a non-profit that handles donor data
The course, guides and glossary
The free course, AI Safety for Non-Profits, has 10 lessons. The guides walk through specific tasks. The glossary explains the terms you will see on advisories, such as CVSS. You can also search the whole site.
Where the information comes from
Advisories draw on three public sources:
- the National Vulnerability Database (NVD), run by NIST, whose data is in the public domain
- the GitHub Advisory Database, licensed CC BY 4.0
- the CISA Known Exploited Vulnerabilities catalog, in the public domain
Tool profiles are based on the vendors’ own published policy pages. The sources page lists each source and its license.
Analyses and long-form pages are drafted with the help of an AI model from the stored source facts and reviewed before publishing, and every fact can be traced to a linked source. The methodology page explains how we handle sources, severity, dates and review.
How to start this week
You do not need to read everything. Pick the starting point that fits your role.
If you lead a non-profit or small organization
- Open the tool profiles and find one AI tool your staff already use.
- Read the verdict for non-profits handling donor data, and check the opt-out and retention sections.
- If something surprises you, note it and raise it with whoever manages that tool’s account.
- Start the first lesson of the course. The lessons are short enough to fit into a week alongside other work.
If you are IT staff or a developer
- List the AI software and services your organization runs, including open-source models and libraries.
- Find each one on the vulnerabilities page.
- Add each product’s RSS feed to your feed reader.
- Read any open Critical or High advisories first. The “what to do” section tells you the next step.
If you work in governance or compliance
- Read the methodology page to see how severity is assigned and how pages are dated and reviewed.
- Check the sources page for the databases and licenses behind each record.
- Use the tool profiles as a starting checklist when you review a new AI tool.
What every page promises
You will see four promises across the site:
- Sourced. Every advisory links to the public record it comes from.
- Dated. Every page shows when Securaity published it and when the source last changed.
- Plain-language. Pages are written for the people who have to decide, not only for specialists.
- Free. No sign-up and no paywall.
The dates matter. A vendor can change a retention policy, and a database can update a score. When you read a page, check both dates so you know how current it is.
How to send a correction
If you find a mistake, a missing product or a source that has changed, tell us by email through the contact page. Include the page address and what you think is wrong. We review corrections against the linked sources, and when we update a page, the dates on it change too.
Published Updated