A short, fixed-scope engagement that finds every AI tool your team is actually using, maps the data flows, and hands you a risk-ranked report. Most clients start here.
Every department is using something. Marketing is using ChatGPT for copy. Sales is using a meeting transcription tool. Engineering has Copilot and Cursor. HR is testing a hiring assistant. Finance pasted last quarter's actuals into Claude to "see what it would say." None of it is in your CIO's inventory.
A Shadow AI Audit fixes that — without forcing you to run it yourself or wait six months for an internal initiative to spin up.
Every Shadow AI Audit produces the same artifacts so you can compare engagements quarter over quarter and your team can act without asking.
Same playbook every engagement — you know exactly what's happening and when. Senior advisor sign-off at every gate.
60-min kickoff call. Confirm scope, name stakeholders, schedule department-head interviews, draft the employee comms message.
Pull SaaS spend reports, procurement records, browser extension inventory, DLP/CASB logs. Anonymous 5-question employee survey goes out.
30-min structured interviews with each department head. Categorize discovered tools by use case, data class, oversight gap. Apply risk-ranking rubric.
Analyst drafts the deliverables. Senior advisor reviews and signs off. 90-minute live readout with your leadership team. Q&A.
Three patterns show up in nearly every audit. Knowing this in advance doesn't make the audit less valuable — it makes the conversation faster.
In every audit we've run, at least one team is pasting customer-identifiable data into a consumer ChatGPT account or similar. Usually not malicious — usually someone trying to be helpful and doesn't know the data terms.
Marketing has Jasper, Sales has Copy.ai, Operations has ChatGPT Team. Three subscriptions, similar feature set, no shared learning. Consolidation typically pays for the audit within 90 days.
Often a hiring AI, a customer service bot, or a financial document automation that one team rolled out, that materially affects people, and that has zero oversight. Not deliberately hidden — it just never came up at leadership.
AI line items are growing 10–25% month-over-month, charged on department credit cards, never landing in your IT budget. Procurement has no view. Finance treats it as miscellaneous SaaS.
After the readout you'll have a clear roadmap. Most clients pick one of three paths from there:
No retainer, no follow-on. We hand off completely. Some clients have the internal capacity and prefer this. We don't push back.
We become your standing operational layer — quarterly reviews, training cadence, vendor work, hotline access. Most common path.
Often Acceptable Use Policy, Tooling Architecture, or a specific Use Case Rollout flagged in the audit. Project-based, contained.
Book a 30-minute scoping call. We'll confirm fit, walk through the playbook, and quote a fixed price.