How is my Shadow AI risk score calculated?

Each of the seven questions contributes points based on how much unmanaged AI usage you have and how few controls are in place. Higher adoption, regulated data and weaker controls raise the score. The points are normalised to a 0 to 100 scale and mapped to a tier: Low, Moderate, Elevated or Critical.

Is the assessment free?

Yes. The assessment is completely free, takes about two minutes and shows your score and tailored recommendations immediately. You do not need to enter an email to see your result.

What do I get at the end?

You see your 0 to 100 risk score, your tier and three to five recommendations tailored to your answers. You can optionally request a full report and a step-by-step remediation plan by email, or start a 30-day free trial of Aona.

How is this different from a compliance or maturity assessment?

This tool scores your live Shadow AI exposure right now: how much unmanaged employee AI usage, data-leakage risk and unsanctioned-tool risk you carry today. It is not a regulatory gap analysis or a governance maturity model.

What is a Shadow AI risk assessment?

A Shadow AI risk assessment measures how much unmanaged, unsanctioned AI usage exists across your workforce and how exposed it leaves your data. It covers your size and industry context plus six controllable dimensions: acceptable-use policy, visibility into employee AI usage, data controls at the point of use, current AI tool adoption, incident history, and device and identity management. The same dimensions are available on this page as a downloadable audit checklist.

Profitez de 30 jours d'essai gratuit pour cartographier vos risques d'IA générative :30 jours d'essai gratuit, risques IA générative :Commencer

Demander une démo

Évaluation gratuite du risque Shadow AI

Évaluez votre exposition au Shadow AI

Répondez à sept questions rapides sur la manière dont vos collaborateurs utilisent l'IA aujourd'hui. Nous évaluerons votre risque d'IA non gérée de 0 à 100 et vous montrerons par où commencer. Environ deux minutes. Aucun e-mail nécessaire pour voir votre résultat.

Question 1 sur 813%

Combien de collaborateurs compte votre organisation ?

Plus il y a de personnes, plus la surface d'usage d'IA non autorisée est étendue.

Free audit checklist

Shadow AI Risk Assessment Checklist

Aona's free interactive Shadow AI risk assessment scores your exposure from 0 to 100. This checklist turns the same dimensions into audit questions you can work through with IT, security and compliance. Your organisation's size and industry set the context; the six areas below are the ones you can actually change.

Visibility and discovery

Inventory every AI tool in use
Can you produce a list of every AI tool employees have used in the last 30 days, including free browser-based tools?
Move beyond surveys
Is your visibility based on real usage telemetry rather than self-reporting or an annual questionnaire?
Map the data flows
Do you know which AI tools receive company data via typed prompts, copy-paste or file uploads?

Policy and acceptable use

Publish a written AI policy
Is an AI acceptable-use policy written, communicated and acknowledged by every employee?
Name approved tools and banned data
Does the policy list approved tools, prohibited data categories and an approval path for new tools?
Enforce it technically
Is the policy backed by controls at the point of use, rather than relying on trust alone?

Controls at the point of use

Block sensitive data in real time
Can you stop PII, client data, credentials or source code before it reaches an AI tool?
Redact instead of banning
Can you redact sensitive fields so employees keep the productivity without the exposure?
Cover files, not just prompts
Do your controls inspect file uploads as well as typed text?

Sanctioned AI adoption

Offer approved alternatives
Have you sanctioned enterprise-grade options for the ChatGPT, Copilot, Gemini and Claude use cases employees already have?
Retire consumer accounts
Are enterprise tiers, with training-data opt-outs, SSO and data residency, replacing personal accounts?
Make approval fast
Is there a well-known, fast route to request a new AI tool so employees do not route around IT?

Incident readiness

Have a response plan
Is there a documented plan for an AI-related data exposure, with named owners and timelines?
Test your detection
Would your monitoring actually flag sensitive data pasted into an unsanctioned AI tool today?
Learn from near-misses
Are past AI incidents and near-misses reviewed for root cause and fed back into controls?

Device and identity foundations

Enrol devices
Are endpoints under MDM or Intune so AI controls can be deployed and enforced at scale?
Centralise identity
Is access to sanctioned AI tools governed through SSO, with Entra or a similar identity provider?
Account for unmanaged devices
Do you know how much AI usage happens on BYOD and unmanaged devices, and is it in scope?

Download the checklist (PDF)

One A4 page, no email required. You can also print this section directly from your browser.

Go deeper

AI Security Audit Checklist template — 85+ controls across 7 domains for auditing production AI systems, free to download.
AI Risk Assessment Checklist template — a structured risk-scoring worksheet for evaluating individual AI systems.
Browse all free AI governance and policy templates — acceptable-use policies, incident response plans, EU AI Act and ISO 42001 tools.

FAQ

Questions fréquentes

Chacune des sept questions attribue des points selon l'ampleur de votre usage d'IA non géré et la rareté des contrôles en place. Une adoption plus forte, des données réglementées et des contrôles plus faibles augmentent le score. Les points sont normalisés sur une échelle de 0 à 100 et associés à un niveau : faible, modéré, élevé ou critique.

Constatez votre exposition réelle au Shadow AI, pas une estimation

Exécutez Aona en parallèle de vos outils existants pendant 30 jours. Découvrez chaque outil et agent d'IA, prouvez où vont les données sensibles et activez l'application là où cela compte.

Démarrer l'essai gratuit Réserver une démo