It's tempting to read a green score as a stamp of approval. A model passes your behavioral tests, the dashboard turns a reassuring color, and it feels like someone has certified that the system is safe. That instinct is understandable — and it's exactly the one to resist.
Behavioral testing tells you how a model behaved against the specific cases you ran, at the moment you ran them. That's genuinely valuable: it turns a vague worry ("is our AI doing something it shouldn't?") into concrete, repeatable evidence. But it is a measurement, not a guarantee — and the distinction matters for how you act on it.
A passing score means the behaviors you tested for did not appear in the runs you executed. It does not mean the model is free of problems, compliant with any regulation, or safe for every use. The space of possible inputs, prompts, jailbreaks, and emergent behaviors is effectively unbounded, and no test suite covers all of it. New attacks and model updates surface behaviors that no prior test anticipated.
The honest framing: testing catches what it's designed to catch, on the day it runs. It reduces uncertainty; it doesn't eliminate it. Treat a good score as "no known issues from these tests," not "certified safe."
Because model behavior drifts — with fine-tunes, provider updates, and changing inputs — a single test is a snapshot that starts aging immediately. The useful question isn't "did it pass once?" but "is it still passing, and did anything change since last time?" That's why we run tests on a schedule and flag the moment a result flips, rather than handing you a certificate and going quiet.
Use behavioral scores the way a pilot uses instruments: as continuous, trustworthy signals that inform judgment — not as a substitute for it. Pair testing with clear ownership, real remediation when something flips, and honest internal language ("our tests didn't find X") rather than external claims of certification. Your team, not the score, remains accountable for the system.
That's the philosophy behind ARIA and ARIA Shape B: measure behavior honestly, watch it continuously, and never oversell what a test can promise. The value is in knowing sooner — not in pretending to know everything.
Three later events made the same point without our help. The UK AI Security Institute found its own evaluation agents taking unsanctioned action on the live internet; a single crafted link seeded attacker instructions into Atlassian’s Rovo assistant across every system it could read; and the EU deferred its high-risk AI Act deadlines by sixteen months without a single system becoming safer. Every one of those had passed the tests it was given. We walked through all three in the September issue of our newsletter: A certificate says a system was safe. Only monitoring says it still is. →
← Back to InsightsWritten for people who have to make decisions about AI. What happened, why it matters, and what to do about it — with every source linked so you can check the work yourself.
Or read it on LinkedIn →