Shadow AI · discovery & triage

Shadow AI Discovery & Risk-Triage Kit

You can't govern what you can't see. List every AI tool your team actually uses — amnesty, no blame — and triage which ones to pull into governance first, before one of them quietly takes regulated data out the door.

The honest first move isn't a ban — it's an amnesty. People only tell you the truth about the tools they use when admitting one isn't a confession. This kit turns that honest list into a triage.
Get the Kit $69

instant download · .xlsx · yours to keep

The problem

The tools you don't know about are the ones that hurt.

1 in 5

organizations have had a breach tied to employees using unsanctioned shadow-AI tools.

~37%

have any policy or detection to manage it — most are flying blind on what's actually in use.

Amnesty first

the consensus first move: discover without blame, because banning tools just pushes them onto personal accounts.

Shadow AI isn't a discipline problem — it's a visibility problem. The fix is to surface the real list, then triage it by what actually creates exposure: regulated data, personal accounts, and vendors that train on your data. This kit does the triage so you know which tool to bring in first.

See it work

One regulated tool on a personal login flips the whole org.

Try it — a sample inventory

Tap any field to cycle it. One regulated tool on a personal account makes the whole org UNGOVERNED.

ChatGPT (free, personal logins)PULL INTO GOVERNANCE

Regulated data on a personal account — trips the org gate.

Notion AI (team workspace)REVIEW

Governed but imperfect — tighten sanction, account, or training.

Otter.ai meeting notesPULL INTO GOVERNANCE

Unsanctioned and touches personal/regulated data.

Approved coding copilot (SSO)SANCTIONED

Approved, SSO, exposure handled.

UNGOVERNED2 of 4 to pull in · exposure 50%

Gate tripped: a tool processes regulated data on a personal account. The data is outside your control and the account can't be revoked — UNGOVERNED regardless of how many tools are clean.

Bring into governance first: ChatGPT (free, personal logins).

Grades the tools, never people. A discovery aid — not monitoring, a scan, or an audit. Runs offline in the .xlsx.

What's inside

One workbook. Four columns. A live triage.

Sanction status

Sanctioned, under review, or unsanctioned — the difference between a governed tool and a blind spot.

Data sensitivity touched

None, low, personal, or regulated. Regulated data is what turns a convenience into a liability.

Account type

SSO-managed, mixed, or a personal login you can't revoke when someone leaves.

Vendor training & retention

Controlled, unclear, or trains on your data — does your input become someone's training set?

The standard

The combination decides it — not a score.

Structural, not scored

A tool is PULL INTO GOVERNANCE when it has a biting exposure, SANCTIONED only when fully clean, REVIEW in between. Forcing a 0–100 number onto categorical facts would be less honest than letting the combination speak.

One gate that's dispositive

Regulated data on a personal account makes the whole org UNGOVERNED, however many tools are clean — the exposure a coverage percentage hides.

Grades tools, not people

Every verdict routes a tool toward governance, never an accusation about who used it. Amnesty is the point: you only fix what people are willing to show you.

Who it's for / not for

For the person who has to answer “what are we using?”

For
  • Founders, ops, and IT leads taking the first honest inventory of AI tools in use.
  • Anyone who needs to know which unsanctioned tool to bring into governance first.
  • Teams preparing for an audit, an insurer, or a customer security questionnaire.
Not for
  • Monitoring or scoring employees — it grades the tools, never the people.
  • Network scanning or automatic detection — you supply the inventory, by amnesty.
  • A governance program in a box — it triages and routes; it doesn't contract or remediate. Not legal advice.

Pairs well with

Discover here, then govern there.

AI Vendor & Sub-Processor Data-Flow Register
$89

Once a tool is pulled in, register its data flows and grade whether each is governed.

View
“Pass a 90-Day AI Audit?” Readiness Triage
$79

Find out whether your AI governance evidence would survive an auditor's request in 90 days.

View
AI Governance & Acceptable Use Starter Kit
$39

The editable policy templates that turn a sanctioned-tool list into an actual acceptable-use baseline.

View

Common Questions

Straight answers before you buy.

No. It is not a network scan, a monitoring tool, or a security audit, and it watches no one. It is an amnesty-based discovery worksheet: your team lists the AI tools they actually use, with no penalty for honesty, and the kit triages which ones to bring into governance first. It grades the tools and how they're handled — never the people who use them. Discovery works precisely because admitting a tool isn't treated as a confession.

Get the kit

See it, triage it, govern it.

  • One .xlsx — Start Here, Dashboard, Shadow AI Triage.
  • Live verdicts, exposure rate, and the tool to govern first.
  • Instant download, yours to keep, opens anywhere.

A discovery and triage aid — not monitoring, a scan, or a security audit. Grades the tools, never people. Lightly regulated; not legal advice.

$69

one-time

Buy the Kit

← Browse all Quick Kits

Sold by RedHub AI LLC · Secured by Stripe · redhub.ai