Security evaluations often end where operational work should begin: with a score. A useful evaluation does more than rank models. It tells a team what failed, under which conditions, and which control should change.
Test the system you deploy
A model-only test misses retrieval, tool permissions, system prompts, application logic, and human approval flows. Those layers decide whether undesirable text becomes an actual incident.
Build cases around complete abuse paths. Record the preconditions, attacker input, model behavior, downstream action, and control response. This makes results comparable across releases without pretending that one number describes the whole system.
Prefer durable signals
The strongest signals map directly to decisions: block rate for unauthorized tool calls, sensitive-data exposure by source, approval bypass rate, and time to safe recovery after adversarial input.
Use a small, versioned regression set for every release and a broader exploratory campaign on a regular cadence. Static tests protect known boundaries. Human exploration finds the next boundary you forgot to draw.