AI Exposure Review
What is already happening here?
Who asks
A security, IT or compliance lead usually starts this one, having found one AI tool nobody approved and having no way to tell whether it is the only one.
What we look at
The work starts with records the organization already holds: expense lines and vendor invoices, OAuth grants and connected applications in the identity provider, browser extensions in use, and whatever integrations are already wired into repositories, ticket systems, and shared drives. Then we sit with department heads and ask what people actually use, which is where the tools that were never billed to anyone turn up. For each tool found, we establish what data has been put into it and what that tool can reach on its own. Each finding is written against the NIST AI RMF function it belongs to as it is recorded, so the register arrives in the same vocabulary the rest of the work uses.
What you get
Key deliverables
- A tool and agent inventory, including what nobody registered
- Data exposure findings naming what went into which tool
- A risk register mapped to the NIST AI RMF
- A dated baseline secure score
What this does not cover
A review finds and rates. It does not remediate, so nobody's access is revoked and no tool is switched off as part of this work, and the decision about which tools stay lives in the approval process written under Governance Setup. This is also not a readiness assessment. It reads exposure rather than capability, and capability is what the Readiness Baseline reads, as one figure for the organization that comes apart into the four NIST functions.
What lands in the platform
Every tool found is registered in the vendor catalog and assigned to the departments using it, and each one carries its status as active, inactive, or in evaluation. The risk register lands as a gap register where each gap holds a severity and can later be marked addressed, with the record keeping who marked it and when. The baseline score is stored with the date it was taken and with both readings kept, the model's and the reviewer's, which is what the next review gets compared against.
Next step
Export the list of connected OAuth applications from your identity provider and send it over, and we will tell you which of them are AI tools and what those tools can reach.