How much shadow AI is running through your company?
Your people are using AI tools — some you approved, many you didn't. Answer ten questions about what's flowing and what contains it, and get an indicative exposure score plus the three areas to investigate first. No email, no wait: the score is the mirror, not the sales pitch.
01 · What is flowing
01How much of your team uses AI tools in their day-to-day work?
02Where do the AI tools your people use actually come from?
03What kind of content flows through those tools?
04Do you know what those tools do with what you give them?
05Do outsiders — contractors, agencies, freelancers — use their own AI tools on your work?
06Has anything already gone somewhere it shouldn’t have?
02 · What contains it
07Could you produce a list of every AI tool your company uses?
08Is there a policy for what may go into an AI tool?
09Are your people trained on what is safe to share with AI tools?
10What technically stops sensitive data reaching an unapproved AI service?
03 · Your exposure
Answer the ten questions above — or load a typical firm — and the score, the exposure split, and the three areas to investigate first appear here. Nothing is sent anywhere unless you later ask us to email the report; the whole rubric runs in this page.
How the scoring works
Shadow-AI risk is what is flowing times how little is containing it. Six questions size the flow; four size the containment. Each answer carries a value from 0 to 100 and a weight — stated below, our editorial call — and the final score is the weighted flow multiplied by a containment factor your control answers earn, between 0.15 and 1.0. Good controls dampen exposure by 85% at best, never erase it: residual risk never reaches zero, and a tool inventory nobody keeps current is a control that has already expired.
| Area | The question behind it | Side | Weight |
|---|---|---|---|
| Volume of use | How much of your team uses AI tools in their day-to-day work? | What is flowing | 2 |
| Tool vetting | Where do the AI tools your people use actually come from? | What is flowing | 3 |
| Data classes | What kind of content flows through those tools? | What is flowing | 4 |
| Data handling terms | Do you know what those tools do with what you give them? | What is flowing | 2 |
| Third parties | Do outsiders — contractors, agencies, freelancers — use their own AI tools on your work? | What is flowing | 2 |
| Incident signals | Has anything already gone somewhere it shouldn’t have? | What is flowing | 2 |
| Visibility | Could you produce a list of every AI tool your company uses? | What contains it | 3 |
| Policy | Is there a policy for what may go into an AI tool? | What contains it | 2 |
| Training | Are your people trained on what is safe to share with AI tools? | What contains it | 2 |
| Technical controls | What technically stops sensitive data reaching an unapproved AI service? | What contains it | 3 |
The three findings are ranked by each area's approximate contribution to the final score — where the points actually came from. Data classes carry the heaviest weight on purpose: the data class sets the blast radius of everything else. Visibility carries the heaviest control weight because you cannot risk-score what you cannot see, and every other answer in the quiz improves once that one does.
What a score means — and what it does not
A low score on this quiz is not a clean bill of health; it is the least exposure your answers can admit to. The whole subject of shadow AI is that leadership reliably underestimates it — a firm we assessed believed AI use was limited to an approved pilot and turned out to have sixty unsanctioned tools in daily use. If your visibility answer was weak, the number above is a floor, not a ceiling — we say so on the result itself.
Three honest caveats. The weights are ours — reasonable people would nudge every row of that table, and the point is the conversation it starts, not the second decimal. The answers are yours, and people systematically under-report what flows because the tools are invisible from the corner office. And ten questions cannot see browser extensions, API keys buried in scripts, or what your contractors run on their own laptops — a quiz that pretended otherwise would be the least honest thing on this site.
We do not ask for an email to show you the score, because a number held hostage is a number we do not trust either. This is the same instrument logic as our agent-readiness check and skills-gap checker: an honest, instant, ungated read — then the choice of what to do about it.
From a score to an inventory
The first-move notes on your findings are things you can do this week for free. What they cannot do is see what telemetry sees. Our AI risk & security assessment maps every AI touchpoint in your organisation — sanctioned and shadow — through interviews and telemetry, scores each finding by data sensitivity and blast radius, and ends with a remediation plan that has owners and dates. The firm with sixty unsanctioned tools entered its audit with a complete inventory and three data-leakage risks already closed.
Bring your quiz result to the first call and the framing conversation is already half done. Or start with a conversation — the check is free either way, and nothing you answered leaves your browser unless you ask us to email the report.
One email a month on practical AI adoption
What we ship for clients, what the tools can honestly do this month, and one thing worth trying in your own team — written by us, no hype, unsubscribe anytime.