THE SHADOW AI DISCOVERY
Your Team Is Already Using AI. The Question Is Whether You Know About It.
ChatGPT, Copilot, Grammarly, Perplexity – your staff are using them right now. Some of them with sensitive organizational data. We’ll show you exactly where your exposure is.
Shadow IT has always existed. Shadow AI is a different problem entirely.
When an employee pastes a client intake form into ChatGPT, or runs donor correspondence through an AI writing tool – your organizational data has left the building. Quietly. Without a policy violation anyone noticed.
The Shadow AI Discovery shows you where AI exposure exists – and what to do next.
The risk most organizations don’t know they have
AI tools spread through organizations fast – one employee finds something useful and within a month half the team is using it. The problem is that most of those tools are processing, storing, or training on whatever gets typed into them. Your data agreements, privacy policies, and retention schedules don’t apply.
In a regulated environment that’s a compliance issue. In any environment it’s a trust issue.
The Shadow AI Discovery is non-invasive and anonymous for employees. We don’t install surveillance tools. We don’t name names. We give your leadership the picture they need – and we’ll have recommendations ready.
Your report tells you three things
-
- Which AI tools your team is using – every tool, categorized by risk tier
- What data has been exposed – what’s been shared, with which services, and how often
- What to do about it – prioritized governance actions, immediate and longer term
No surveillance. No blame. A clear picture of your organization’s AI exposure, ready to take to your leadership team.
See what tools your team is using.
The Process
Survey. Scan. Report. A straightforward three-step process.
1. Survey deployment
We provide an anonymized 10–15 question survey built in Microsoft Forms. Your team answers honestly because responses are anonymous. We capture which AI tools they use, how often, and – critically – what types of information they’re inputting.
15 min with you.
2. Technical review
Where web filtering or endpoint management is in place, we review traffic logs for known AI tool domains. We also analyze your Entra sign-in logs for OAuth app consents to AI services. No new agents. No monitoring software. We work with what already exists.
60–90 min internal
3. Report & presentation
Every tool your team uses is categorized and risk-rated. Your leadership gets a clear picture of the exposure – and a prioritized list of governance actions to take immediately, soon, and over time.
60 min with you.
Built for organizations where a data exposure incident would be devastating
Non-profits
Donor data. Beneficiary records. Board communications. If any of that is finding its way into external AI tools, the reputational and funding risk is significant. The Shadow AI Discovery tells you what’s happening before it becomes a crisis.
Professional Services Firms
Legal, healthcare-adjacent, financial services – your client confidentiality obligations don’t pause because an employee found a useful AI tool. We find out what’s being shared and help you build the governance to stop the exposure.
Not the Right Fit For...
Organizations with fewer than 15 employees or those with highly restrictive environments where AI access is already locked down at the network level will get limited value from this assessment. We’ll tell you upfront if that’s the case.
What leadership teams use this for
-
-
-
- AI policy development
- cyber insurance discussions
- board reporting
- acceptable use standards
- Microsoft Copilot readiness
- governance planning
Found exposure? The next step is policy.
The Discovery tells you what’s happening. The Governance Gap Assessment helps you build the policies to govern it — acceptable use, AI tool standards, and decision-making frameworks your team can actually follow. See the Governance Gap Assessment →
-
-
“Third Octet provides access to very skilled people at a fraction of the cost of managing IT internally.”
Get visibility into how AI is already being used across your organization - before it becomes a governance problem.
One survey. One technical review. One report that gives leadership a clear picture of AI exposure and next steps.