Over 40 Years in BusinessISO 27001 compliantPublic sector: GSA contract holder
LA 562-298-5000 · Chicagoland 312-432-5300 · Phoenix 602-733-6807 · Client Support
Over 40 Years in BusinessISO 27001 compliantPublic sector: GSA contract holder
LA 562-298-5000 · Chicagoland 312-432-5300 · Phoenix 602-733-6807 · Client Support
BTI security engineers find the AI tools, accounts, plugins and agents your people already use, map where PII and confidential data could flow into prompts and uploads, compare what they find with your current policy and controls, and deliver a prioritized findings report and roadmap.
Call your local BTI IT team: Los Angeles 323-510-8003 · Chicago 312-492-2613
The problem
Most organizations approved one or two AI tools, then discovered people were using many more. Some of that use is helpful. Some of it sends customer records, employee details, contracts or source material to services nobody reviewed. You cannot set sensible policy for AI use you have not found.
Free chatbots, writing aids, transcription apps and browser extensions show up without a purchase order or a security review.
Staff sign in to approved AI services with personal accounts, so company data lands outside your tenant, retention rules and offboarding.
AI features switched on inside office suites, CRMs, meeting tools and plugins can read and move work data without a separate download.
Agents and automations connect to mailboxes, files, tools and APIs with standing permissions that few people have reviewed.
What we review
The assessment looks at how AI is really used, what data it can touch and which controls already exist. Where they apply to you, findings are mapped to frameworks you already answer to, such as GLBA or CCPA. A mapping is a planning aid, not a certification.
We identify AI tools, accounts, plugins, embedded assistants and agents in use, using sources you approve such as identity, network, endpoint and cloud app records, plus short interviews with the teams that use AI most.
We confirm where PII, regulated records and confidential business data live, then trace the paths by which that data could reach prompts, uploads, transcripts and agent connections.
We review who can sign in to AI services, whether personal accounts are blocked, what permissions apps and agents hold, and how access is removed when people leave.
We compare your acceptable use policy, AI policy and current data loss controls with what discovery found, so you can see where written rules and real behavior differ.
We check whether AI activity is logged, retained and reviewable, and whether you could answer an insurer, auditor or customer security questionnaire about AI use today.
What you get
Every assessment ends with a written report and a readout for your leaders and IT team. You own the report and can act on it with your own staff, your current providers or BTI.
The AI tools, accounts, assistants and agents found, the data each could touch and how each one is reached today.
Each finding ranked by data sensitivity, exposure and business need, so the first fixes are the ones that matter most.
Where your written AI and acceptable use policies are missing, unclear or not enforced, with suggested wording to close the gap.
A prioritized roadmap of identity, data loss, logging and governance controls, sequenced so useful AI work keeps going.
How it works
Which assessment fits
The AI business opportunity assessment covers ROI and where AI can add value, while this assessment is security-scoped and focuses on the AI use, data paths and controls you already have.
Many organizations run both. The security view tells you which AI use to allow, constrain or stop. The opportunity view tells you where governed AI should go next.
Next steps
The roadmap usually points to two kinds of work: technical controls that stop sensitive data from leaving, and a governance program that keeps AI use accountable.
When the report shows PII or confidential data heading to AI tools, AI data loss prevention blocks sensitive content in prompts and uploads, stops unapproved AI tools and keeps activity records for review.
When the gaps are about policy, ownership and oversight, AI security, governance and risk turns the findings into written rules, approval paths and an AI register your leaders can stand behind.
Need a broader written program? See WISP, IR plans and GRC or vCISO and cybersecurity consulting, or start from the cybersecurity services hub.
Questions
Shadow AI is any AI tool, account, plugin or agent used for work without review or approval. It often runs through personal accounts or features built into apps you already own, so normal software inventories miss it. A focused assessment finds that use and shows what data it can reach.
The AI business opportunity assessment covers ROI and where AI can add value. This assessment is security-scoped. It finds the AI already in use, maps where sensitive data could flow and compares that with your policy and controls. Many organizations run both.
We agree the sources, access level and data handling rules with you in writing before work starts. Discovery usually draws on identity, network, endpoint and cloud app records you already have, plus short interviews. Any temporary tooling is listed in the scope for your approval.
The review focuses on where data could flow and which controls exist, not on reading your content. If a sample review is useful, the scope, who can see it and how long it is kept are agreed with you first, and sensitive values can be masked.
Where they apply to your organization, findings can be mapped to frameworks such as GLBA and CCPA, and to your internal policies. The mapping helps you plan and answer questionnaires. It is not a certification or an audit opinion.
You receive a written report and a readout. Common next steps are AI data loss prevention to block sensitive data in prompts and uploads, and AI security governance to formalize policy and oversight. You can act on the roadmap with your own team, your current providers or BTI.
Related pages: AI data loss prevention, AI security governance, free cybersecurity assessment, and the AI business opportunity assessment.
Book a free consultation with a BTI security engineer. We will talk through how AI is used in your organization, the data you need to protect and what a shadow AI and PII data governance assessment would cover for you.
Talk to the BTI IT team: Los Angeles 323-510-8003 · Chicago 312-492-2613
Already a BTI client? Use the dedicated support number assigned to your organization.
Tell us where to reach you and a BTI engineer will follow up within business hours.
Business inquiries only. Please do not include passwords or sensitive records. No cost and no obligation for the consultation.