A short, fixed-scope engagement that finds every AI tool your team is actually using, maps the data flows, and hands you a risk-ranked report. It's the natural place to start.
Every department is using something. Marketing is using ChatGPT for copy. Sales is using a meeting transcription tool. Engineering has Copilot and Cursor. HR is testing a hiring assistant. Finance pasted last quarter's actuals into Claude to "see what it would say." None of it is in your CIO's inventory.
A Shadow AI Audit fixes that — without forcing you to run it yourself or wait six months for an internal initiative to spin up.
Every Shadow AI Audit produces the same artifacts so you can compare engagements quarter over quarter and your team can act without asking.
Same playbook every engagement — you know exactly what's happening and when. One named lead signs off at every gate.
60-min kickoff call. Confirm scope, name stakeholders, schedule department-head interviews, draft the employee comms message.
Pull SaaS spend reports, procurement records, browser extension inventory, DLP/CASB logs. Anonymous 5-question employee survey goes out.
30-min structured interviews with each department head. Categorize discovered tools by use case, data class, oversight gap. Apply risk-ranking rubric.
We draft the deliverables, review, and sign off. Then a 90-minute live readout with your leadership team. Q&A.
A few patterns are common enough across mid-market AI deployments that we design the audit to look for them directly. Knowing them in advance doesn't make the audit less valuable — it makes the conversation faster.
In organizations of this size, it's common for at least one team to be pasting customer-identifiable data into a consumer ChatGPT account or similar. Usually not malicious — usually someone trying to be helpful who never read the data terms.
Marketing has Jasper, Sales has Copy.ai, Operations has ChatGPT Team. Three subscriptions, similar feature set, no shared learning. Consolidating the overlap is often where the audit pays for itself.
Often a hiring AI, a customer service bot, or a financial document automation that one team rolled out, that materially affects people, and that has zero oversight. Not deliberately hidden — it just never came up at leadership.
AI line items are growing 10–25% month-over-month, charged on department credit cards, never landing in your IT budget. Procurement has no view. Finance treats it as miscellaneous SaaS.
After the readout you'll have a clear roadmap. From there, there are three common paths:
No retainer, no follow-on. We hand off completely. If your team has the internal capacity and prefers this, we don't push back.
We become your standing operational layer — quarterly reviews, training cadence, vendor work, executive briefings. The natural next step when you want it handled.
Often the AI Policy & Trust Pack, Vendor & Tooling Selection, or a specific AI Use Case Rollout flagged in the audit. Project-based, contained.
Book a 30-minute scoping call. We'll confirm fit, walk through the playbook, and quote a fixed price.