Shadow AI Risk Audit
Find unapproved AI data flows.
A fixed-fee Shadow AI Risk Audit reviews how your team uses public AI tools and documents the data routes, exposure concerns and remediation work within the agreed scope.
Why review the tools in use?
In a Microsoft and LinkedIn vendor survey, 78% of AI users brought their own AI tools to work.
Source: Microsoft and LinkedIn, May 8, 2024.
Among AI users at small and medium-sized companies in that global survey, the figure was 80%.
Source: Microsoft and LinkedIn, May 8, 2024.
Bringing your own tool does not by itself mean the use was unapproved or that data was disclosed.
"Personal-account chat assistant. Leaves the company boundary. No approval recorded."
Check where work data goes.
Chat assistants, coding assistants and meeting summary tools can process work data outside your company boundary. The audit checks tools in use, account approvals, data types and provider terms against your contract restrictions.
CMMC Phase 1 began November 10, 2025 with Level 2 self-assessment requirements in applicable awards and discretion to require Level 2 C3PAO assessments. Phase 2 expands Level 2 C3PAO assessment requirements on November 10, 2026. Check the requirement in your contract. 32 CFR 170.3(e).
An AI data-flow map and remediation plan.
The Shadow AI Risk Audit is a fixed-fee, one-time engagement. You receive a plain-English remediation plan and working documentation. Two to three weeks. No recurring retainer. Scope confirmed in writing before any work begins.
- AI data-flow map: reviewed tools and sensitive-data routes within the agreed scope.
- Risk-ranked findings: documented exposure concerns and priorities.
- Remediation checklist: prioritized actions for the findings.
- Draft Acceptable Use Policy for AI tools: a one-page draft for your team.
- SSP and POA&M language: findings mapped to NIST SP 800-171 for use in your compliance documents.
How we review AI data flows
We use NIST SP 800-171 control 3.13.1 to review communications at external boundaries. The sample shows a staff walkthrough and a revised approved-tools list as evidence for checking the personal-account route.
The business implements changes. The audit documents decisions and verifies the agreed evidence, as shown in the sample checklist. The sample's document excerpts use Rev. 3; CMMC Level 2 uses the Rev. 2 baseline under 32 CFR 170.14(c)(3).
Start with a free call. The audit is a flat fee, no hourly surprises.
AI Risk Call
Free
A 30-minute call to discuss the AI tools your team uses and the work data involved. You leave with at least one actionable finding at no charge. If the audit isn't the right fit, we'll tell you on the call.
Shadow AI Risk Audit
from $1,500 fixed
Founding-client rate for organizations under 25 seats. No overages. The full data-flow map, risk-ranked findings, remediation checklist, AI use policy, and SSP and POA&M language, scoped in writing before work starts.
This founding-client rate exists to validate the offer; it won't hold past the first five engagements. Booking the free call costs nothing and commits you to nothing.
How it works
Free AI risk call
30 minutes. We discuss the AI tools your team uses and the work data involved.
Scope, then audit
If it's a fit, we confirm scope and price in writing first. The access we ask for grows with how much you need checked. Once we have it, the engagement runs two to three weeks: tool inventory, data-flow mapping, risk ranking, and documentation.
Receive the package
You get the full package: data-flow map, risk-ranked findings, remediation checklist, AI use policy, and SSP and POA&M language.
Common questions
We already have an IT policy that covers AI tools.
The audit reviews tool use and data routes against approvals, provider terms and your contract restrictions. A policy and a record of tool use answer different parts of that review.
We're not sure we even handle CUI.
CUI has a government connection and safeguarding or dissemination controls required or permitted by an applicable authority. Client confidentiality alone does not make data CUI. Bring your contract and data markings to discuss what applies. Source: 32 CFR 2002.4(h).
We can't afford a consultant right now.
The founding-client rate is $1,500 fixed, scoped before any commitment.
How do you manage capacity?
ThinkCodec runs one active engagement at a time, with the scope confirmed before work begins.
Discuss your AI tools and work data.
For AI use policies, vendor reviews and ongoing oversight, see AI governance.
See the sample AI governance program
Book a free 30-minute AI Risk Call to discuss the routes you want reviewed.
Book a free AI risk call