01
The population of AI tools
Actively in use, sanctioned and unsanctioned, across the organization.
Shadow AI, the use of AI tools outside sanctioned, governed channels, is where the largest unseen exposure typically lives. This assessment establishes what AI is actually being used across the organization, by whom, for what, and on what data, and quantifies the resulting exposure. It is the assessment most likely to contradict the official account of AI use, which is precisely its value.
Shadow AI is by definition hidden, so the assessment triangulates multiple discovery methods rather than relying on any single one. The discovery mix is tailored to what your organization permits and can support.
Actively in use, sanctioned and unsanctioned, across the organization.
Especially confidential, personal, or regulated data flowing into tools that should not receive it.
Where AI output is influencing outcomes that carry financial, legal, or reputational weight.
Where official policy and inventory diverge from actual practice, in which direction, and by how much.
Discovery never names individuals for discipline. The object is organizational visibility, not employee surveillance. The amnesty-framed survey is what makes the data honest.
Non-punitive, explicitly amnesty-framed. Employees report what they actually use, framed as discovery and not enforcement.
Where available and authorized, network, expense, browser-extension, and SaaS-admin signals identify usage surveys miss. Done within agreed privacy boundaries.
Structured conversations with team leads reveal the workflows where AI has quietly become load-bearing.
For each discovered use we evaluate what categories of data are involved and what exposure that creates against your obligations.
The recommendation set distinguishes valuable shadow uses (which should be sanctioned and supported) from high-exposure ones (which should be remediated or retired). Prohibition is the response of last resort.
A focused discovery engagement that reveals what AI is actually running, what data it touches, and what to do about it.