How is my Shadow AI risk score calculated?

Each of the seven questions contributes points based on how much unmanaged AI usage you have and how few controls are in place. Higher adoption, regulated data and weaker controls raise the score. The points are normalised to a 0 to 100 scale and mapped to a tier: Low, Moderate, Elevated or Critical.

Is the assessment free?

Yes. The assessment is completely free, takes about two minutes and shows your score and tailored recommendations immediately. You do not need to enter an email to see your result.

What do I get at the end?

You see your 0 to 100 risk score, your tier and three to five recommendations tailored to your answers. You can optionally request a full report and a step-by-step remediation plan by email, or start a 30-day free trial of Aona.

How is this different from a compliance or maturity assessment?

This tool scores your live Shadow AI exposure right now: how much unmanaged employee AI usage, data-leakage risk and unsanctioned-tool risk you carry today. It is not a regulatory gap analysis or a governance maturity model.

What is a Shadow AI risk assessment?

A Shadow AI risk assessment measures how much unmanaged, unsanctioned AI usage exists across your workforce and how exposed it leaves your data. It covers your size and industry context plus six controllable dimensions: acceptable-use policy, visibility into employee AI usage, data controls at the point of use, current AI tool adoption, incident history, and device and identity management. The same dimensions are available on this page as a downloadable audit checklist.

Prueba gratuita de 30 días para descubrir riesgos de IA generativa -30 días de prueba de riesgos de IA generativa -Empezar ahora

Solicitar una demo

Evaluación gratuita del riesgo de Shadow AI

Puntúe su exposición al Shadow AI

Responda siete preguntas rápidas sobre cómo su personal usa la IA hoy. Puntuaremos su riesgo de IA no gestionada de 0 a 100 y le mostraremos por dónde empezar. Tarda unos dos minutos. No se necesita correo electrónico para ver su resultado.

Pregunta 1 de 813%

¿Cuántos empleados tiene su organización?

Más personas significa una mayor superficie para el uso no autorizado de la IA.

Free audit checklist

Shadow AI Risk Assessment Checklist

Aona's free interactive Shadow AI risk assessment scores your exposure from 0 to 100. This checklist turns the same dimensions into audit questions you can work through with IT, security and compliance. Your organisation's size and industry set the context; the six areas below are the ones you can actually change.

Visibility and discovery

Inventory every AI tool in use
Can you produce a list of every AI tool employees have used in the last 30 days, including free browser-based tools?
Move beyond surveys
Is your visibility based on real usage telemetry rather than self-reporting or an annual questionnaire?
Map the data flows
Do you know which AI tools receive company data via typed prompts, copy-paste or file uploads?

Policy and acceptable use

Publish a written AI policy
Is an AI acceptable-use policy written, communicated and acknowledged by every employee?
Name approved tools and banned data
Does the policy list approved tools, prohibited data categories and an approval path for new tools?
Enforce it technically
Is the policy backed by controls at the point of use, rather than relying on trust alone?

Controls at the point of use

Block sensitive data in real time
Can you stop PII, client data, credentials or source code before it reaches an AI tool?
Redact instead of banning
Can you redact sensitive fields so employees keep the productivity without the exposure?
Cover files, not just prompts
Do your controls inspect file uploads as well as typed text?

Sanctioned AI adoption

Offer approved alternatives
Have you sanctioned enterprise-grade options for the ChatGPT, Copilot, Gemini and Claude use cases employees already have?
Retire consumer accounts
Are enterprise tiers, with training-data opt-outs, SSO and data residency, replacing personal accounts?
Make approval fast
Is there a well-known, fast route to request a new AI tool so employees do not route around IT?

Incident readiness

Have a response plan
Is there a documented plan for an AI-related data exposure, with named owners and timelines?
Test your detection
Would your monitoring actually flag sensitive data pasted into an unsanctioned AI tool today?
Learn from near-misses
Are past AI incidents and near-misses reviewed for root cause and fed back into controls?

Device and identity foundations

Enrol devices
Are endpoints under MDM or Intune so AI controls can be deployed and enforced at scale?
Centralise identity
Is access to sanctioned AI tools governed through SSO, with Entra or a similar identity provider?
Account for unmanaged devices
Do you know how much AI usage happens on BYOD and unmanaged devices, and is it in scope?

Download the checklist (PDF)

One A4 page, no email required. You can also print this section directly from your browser.

Go deeper

AI Security Audit Checklist template — 85+ controls across 7 domains for auditing production AI systems, free to download.
AI Risk Assessment Checklist template — a structured risk-scoring worksheet for evaluating individual AI systems.
Browse all free AI governance and policy templates — acceptable-use policies, incident response plans, EU AI Act and ISO 42001 tools.

Preguntas frecuentes

Cada una de las siete preguntas aporta puntos en función de cuánto uso no gestionado de la IA tiene y de lo escasos que son los controles establecidos. Una mayor adopción, los datos regulados y unos controles más débiles aumentan la puntuación. Los puntos se normalizan a una escala de 0 a 100 y se asignan a un nivel: bajo, moderado, elevado o crítico.

Vea su exposición real al Shadow AI, no una estimación

Ejecute Aona junto a sus herramientas existentes durante 30 días. Descubra cada herramienta y agente de IA, demuestre adónde van los datos sensibles y active la aplicación donde importa.

Iniciar prueba gratuita Reservar una demo