AI Risk & Exposure Assessment

← All AI Security & Governance services

What we look at

• Shadow AI. The AI tools and features actually in use across the business, including ones nobody approved, found through interviews, a short staff survey, and a review of your software and browser extensions.
• Data flows. Where personal and confidential information enters each tool, where it is stored, and who can see it, drawn as a simple map.
• Vendor terms. For each AI provider: whether your data is used to train models, how long it is kept, where it is processed, and what the contract lets you do about it.
• Access. What each AI assistant, integration and automation can reach, and whether that is more than its job needs.
• Policy and people. What staff have been told about AI, and what they do in practice.
• Obligations. Which privacy, security and industry rules apply to the data involved.

What you get

• An AI inventory: every tool and workflow, its owner, and the data it touches.
• A data-flow map for your highest-risk systems.
• A risk register rated by likelihood and impact, mapped to the NIST AI Risk Management Framework.
• A prioritized remediation plan: quick wins this month, then the bigger fixes.
• A plain-English executive summary for owners, boards or examiners.
• A walkthrough meeting to go through the findings with your team.

How it runs

Typically two to three weeks from kickoff to report, depending on the size of the business and how many systems are in scope. We ask for a point of contact, read-only access to the admin consoles in scope, and an hour or two of interviews with the people who use AI most. We do not need, and do not ask for, copies of your customer data.

Who it is for

Any business that handles customer information and has started using AI, whether or not anyone decided it should. It is also the right first step before red team testing or a governance program, because it tells you where those are worth spending money.