Shadow AI Exposure Assessment
No measurement taken
Built with
Client work
The service belongs to the consultancy that sells it, so the methodology document is not mine to publish.
Working with a cybersecurity consultancy, I helped build a Shadow AI exposure assessment service from the ground up. It audits how employees actually use AI tools, assesses where company data is leaking, and finds the gaps in governance.
The methodology runs in four stages: discovery (mapping the AI tools in use), risk evaluation (classifying data exposure), regulatory mapping (GDPR, the EU AI Act, NIS2, DORA), and a remediation plan. It targets mid-to-large organisations in regulated industries, where the risk is real and the compliance burden is heavy.
My role sits on the pre-sales and design side: shaping the offer, the methodology, and the partner integrations that deliver it.
What this does not show
- A methodology and pre-sales credential. I designed the service; I have not personally run an assessment end to end.
- No engagement outcomes are claimed.