We have not officially adopted AI. Do we still need this?

Yes, if people have browsers. Unofficial use is the usual starting point. The assessment is how you find it without a witch hunt.

Will you ban every tool?

No. We help you pick what is allowed, what stays in the tenant, and what is a fireable mistake — then we help you enforce that.

Assessment

See how AI tools already sit in the firm — and what they can leak.

Staff are already pasting matters, returns, and vendor files into chat tools. An AI security assessment maps where that happens, what leaves the Microsoft 365 or Google tenant, and what policy plus technical controls you need before a partner says yes to a wider rollout.

Book a call Write the desk

Who it is for

Managing partners and IT leads who know AI is in the building and cannot yet answer a client or carrier who asks how you keep their files out of a public model.

What you leave with

A map of AI tools in use — approved, shadow, and browser extensions.
A clear picture of data that can leave: prompts, file uploads, plugins, and copilot scopes.
A control list: tenant settings, DLP, approved apps, and a one-page staff rule you can actually send.

How it starts

A person answers and schedules a working session with whoever owns IT and risk.
We review tenant settings, browser use, and how work actually moves — not a survey only.
You get a written finding and a first-week change list. Steve or the desk stays on the thread.

The risk is not “AI” as a slogan. It is a junior staffer uploading a binder to a free chatbot, a Copilot scope that can see more shares than the partner intended, or a browser plugin that reads mail. We look at those paths the same way we look at phishing: what a tired person would do on a Thursday.

The assessment is answer-first. You should be able to tell a client: here is what we allow, here is what we block, here is who to call if something was pasted that should not have been.

This sits next to the readiness assessment. Readiness is MFA, backups, and proof. AI security is the new hole in that same wall. Many firms need both.

Questions firms ask

We have not officially adopted AI. Do we still need this?: Yes, if people have browsers. Unofficial use is the usual starting point. The assessment is how you find it without a witch hunt.
Will you ban every tool?: No. We help you pick what is allowed, what stays in the tenant, and what is a fireable mistake — then we help you enforce that.