Score your shadow AI exposure.
Fifteen yes-or-no questions about the AI tools your people have connected to company data. It takes about four minutes. You get a score out of 15, the gaps behind it, and a first move for each one.
One point for every yes. A score of 0 to 8 reads Exposed, 9 to 12 Blind spots, 13 to 15 On the record.
What the fifteen questions cover
Five areas, three questions each. They follow the order an auditor, an insurer, or a large client tends to ask in: what is connected, what it can reach, what the rules are, who the vendors are, and what you can show.
- Inventory
- Whether you have a current list of the AI tools in use, and of the third-party apps that hold access to your Google Workspace or Microsoft 365 data.
- Access
- Whether you know what each connected app can read, who is allowed to connect a new one, and what happens to those connections when someone leaves.
- Policy
- Whether there is a written AI policy, whether people have acknowledged it, and whether there is an approved list with a way to ask for something new.
- Vendors and data
- Whether you know how each AI vendor uses what you give it, which tools can reach regulated data, and whether the right agreements are signed.
- Evidence
- Whether you could hand over a dated inventory today, whether grants and revocations are recorded, and whether one named person owns the review.
How the score reads
“Don’t know” counts the same as “no”. If you can’t say, you can’t show it, and showing it is the point.
Exposed
AI tools are touching company data and most of it is off the record. If someone asked what has access today, the honest answer would be a guess.
Blind spots
The basics are in place. There are specific places where a tool could hold access that nobody has reviewed.
On the record
You can see most of what is connected and show your work. What is left is keeping it current.