How is my Shadow AI risk score calculated?

Each of the seven questions contributes points based on how much unmanaged AI usage you have and how few controls are in place. Higher adoption, regulated data and weaker controls raise the score. The points are normalised to a 0 to 100 scale and mapped to a tier: Low, Moderate, Elevated or Critical.

Is the assessment free?

Yes. The assessment is completely free, takes about two minutes and shows your score and tailored recommendations immediately. You do not need to enter an email to see your result.

What do I get at the end?

You see your 0 to 100 risk score, your tier and three to five recommendations tailored to your answers. You can optionally request a full report and a step-by-step remediation plan by email, or start a 30-day free trial of Aona.

How is this different from a compliance or maturity assessment?

This tool scores your live Shadow AI exposure right now: how much unmanaged employee AI usage, data-leakage risk and unsanctioned-tool risk you carry today. It is not a regulatory gap analysis or a governance maturity model.

What is a Shadow AI risk assessment?

A Shadow AI risk assessment measures how much unmanaged, unsanctioned AI usage exists across your workforce and how exposed it leaves your data. It covers your size and industry context plus six controllable dimensions: acceptable-use policy, visibility into employee AI usage, data controls at the point of use, current AI tool adoption, incident history, and device and identity management. The same dimensions are available on this page as a downloadable audit checklist.

Sichern Sie sich Ihre kostenlose 30-Tage-Testversion zur Risikoerkennung für generative KI:30 Tage Risikoerkennung für generative KI:Jetzt starten

Demo buchen

Kostenlose Risikobewertung für Shadow AI

Bewerten Sie Ihre Exposition gegenüber Shadow AI

Beantworten Sie sieben kurze Fragen dazu, wie Ihre Belegschaft KI heute nutzt. Wir bewerten Ihr ungovernertes KI-Risiko von 0 bis 100 und zeigen Ihnen, wo Sie anfangen sollten. Dauert etwa zwei Minuten. Keine E-Mail nötig, um Ihr Ergebnis zu sehen.

Frage 1 von 813%

Wie viele Mitarbeitende hat Ihr Unternehmen?

Mehr Menschen bedeuten mehr Angriffsfläche für nicht genehmigte KI-Nutzung.

Free audit checklist

Shadow AI Risk Assessment Checklist

Aona's free interactive Shadow AI risk assessment scores your exposure from 0 to 100. This checklist turns the same dimensions into audit questions you can work through with IT, security and compliance. Your organisation's size and industry set the context; the six areas below are the ones you can actually change.

Visibility and discovery

Inventory every AI tool in use
Can you produce a list of every AI tool employees have used in the last 30 days, including free browser-based tools?
Move beyond surveys
Is your visibility based on real usage telemetry rather than self-reporting or an annual questionnaire?
Map the data flows
Do you know which AI tools receive company data via typed prompts, copy-paste or file uploads?

Policy and acceptable use

Publish a written AI policy
Is an AI acceptable-use policy written, communicated and acknowledged by every employee?
Name approved tools and banned data
Does the policy list approved tools, prohibited data categories and an approval path for new tools?
Enforce it technically
Is the policy backed by controls at the point of use, rather than relying on trust alone?

Controls at the point of use

Block sensitive data in real time
Can you stop PII, client data, credentials or source code before it reaches an AI tool?
Redact instead of banning
Can you redact sensitive fields so employees keep the productivity without the exposure?
Cover files, not just prompts
Do your controls inspect file uploads as well as typed text?

Sanctioned AI adoption

Offer approved alternatives
Have you sanctioned enterprise-grade options for the ChatGPT, Copilot, Gemini and Claude use cases employees already have?
Retire consumer accounts
Are enterprise tiers, with training-data opt-outs, SSO and data residency, replacing personal accounts?
Make approval fast
Is there a well-known, fast route to request a new AI tool so employees do not route around IT?

Incident readiness

Have a response plan
Is there a documented plan for an AI-related data exposure, with named owners and timelines?
Test your detection
Would your monitoring actually flag sensitive data pasted into an unsanctioned AI tool today?
Learn from near-misses
Are past AI incidents and near-misses reviewed for root cause and fed back into controls?

Device and identity foundations

Enrol devices
Are endpoints under MDM or Intune so AI controls can be deployed and enforced at scale?
Centralise identity
Is access to sanctioned AI tools governed through SSO, with Entra or a similar identity provider?
Account for unmanaged devices
Do you know how much AI usage happens on BYOD and unmanaged devices, and is it in scope?

Download the checklist (PDF)

One A4 page, no email required. You can also print this section directly from your browser.

Go deeper

AI Security Audit Checklist template — 85+ controls across 7 domains for auditing production AI systems, free to download.
AI Risk Assessment Checklist template — a structured risk-scoring worksheet for evaluating individual AI systems.
Browse all free AI governance and policy templates — acceptable-use policies, incident response plans, EU AI Act and ISO 42001 tools.

FAQ

Häufige Fragen

Jede der sieben Fragen trägt Punkte bei, basierend darauf, wie viel ungovernierte KI-Nutzung Sie haben und wie wenige Kontrollen vorhanden sind. Eine höhere Einführung, regulierte Daten und schwächere Kontrollen erhöhen die Bewertung. Die Punkte werden auf eine Skala von 0 bis 100 normalisiert und einer Stufe zugeordnet: gering, mäßig, erhöht oder kritisch.

Sehen Sie Ihre reale Exposition gegenüber Shadow AI, keine Schätzung

Lassen Sie Aona 30 Tage lang parallel zu Ihren bestehenden Tools laufen. Entdecken Sie jedes KI-Tool und jeden Agenten, belegen Sie, wohin sensible Daten fließen, und aktivieren Sie die Durchsetzung dort, wo es darauf ankommt.

Kostenlose Testphase starten Demo buchen