AI / AI risk and security assessment
AI risk and security assessmentWe uncover shadow AI, review the AI vendors that touch your data, assess your AI use against the NIST AI Risk Management Framework, and test the AI tools you build for prompt injection and data leakage.
Browser extensions, meeting bots, AI features inside SaaS tools and personal ChatGPT accounts all move data. Most companies have no inventory and no review process for any of it.
Our Shadow AI and AI Vendor Risk Checklist shows where to look for unapproved AI and the questions to ask every AI vendor.
Find the AI tools, extensions and SaaS features in use, and the data flowing into them.
Training on your data, retention, hosting location, certifications and contract terms.
Each AI use rated against the NIST AI RMF and its Generative AI Profile (NIST AI 600-1).
Hands-on testing of your chatbots, agents and AI features for prompt injection, data leakage and unsafe actions.
Application testing follows the OWASP Top 10 for LLM Applications and runs alongside our penetration testing service.
Agree which business units, tools and AI applications are in scope, with written authorization for any testing.
Review sign-in, network and SaaS data with your IT team or MSP, and survey staff on the AI tools they use.
Rate each use and vendor for risk, and test your AI applications where they're in scope.
A risk register, vendor findings, test results and a prioritized fix list, mapped to your compliance frameworks.
Retest fixes, and fold AI into your policies, vendor reviews and annual risk assessment.
Can be combined with a cyber risk assessment or penetration test.
AI tools and features people use without IT or security approval, from personal chatbot accounts to AI note-takers joining meetings. It's the AI version of shadow IT.
Governance sets the policies and controls. This assessment finds out what is actually happening and how risky it is, so governance is built on facts.
Text hidden in a document, email or web page that tricks an AI tool into ignoring its instructions, leaking data or taking an action it shouldn't. It's one of the most common weaknesses in AI applications.
Yes. AI tools fall under the same access, data handling, vendor and risk assessment requirements as the rest of your environment, and our report maps findings to those controls.
Book a 30-minute call. We'll talk through where AI shows up in your business and scope the right assessment.