30 Days Gen AI Risk Trial -Start Now
Skip to main content
Aona
Book a demo

Free Shadow AI risk assessment

Review your Shadow AI risks

Answer 8 questions about employee AI use and your current controls. See an indicative score and where to investigate next. No email is needed for the result.

Based on your answers. This assessment does not scan devices or AI accounts, and its score is not a measured probability of a breach.

Question 1 of 813%

How many employees does your organisation have?

More people means more surface area for unsanctioned AI usage.

Free audit checklist

Shadow AI Risk Assessment Checklist

Aona's free interactive Shadow AI assessment provides an indicative 0 to 100 review-priority score from your answers. This checklist turns those dimensions into questions for IT, security and compliance. Record the teams, devices, AI services and review period in scope, then validate the reported controls with observed evidence and synthetic tests.

  1. Visibility and discovery

    • Build a scoped AI inventory

      For the teams, devices, client paths and review period in scope, which AI apps were observed and which areas remain unverified?

    • Move beyond surveys

      Is your visibility based on real usage telemetry rather than self-reporting or an annual questionnaire?

    • Map the data flows

      Do you know which AI tools receive company data via typed prompts, copy-paste or file uploads?

  2. Policy and acceptable use

    • Publish a written AI policy

      Is an AI acceptable-use policy written, communicated and acknowledged by every employee?

    • Name approved tools and banned data

      Does the policy list approved tools, prohibited data categories and an approval path for new tools?

    • Enforce it technically

      Is the policy backed by controls at the point of use, rather than relying on trust alone?

  3. Controls at the point of use

    • Block sensitive data in real time

      Can you stop PII, client data, credentials or source code before it reaches an AI tool?

    • Test redaction where supported

      For the chosen AI app, input and client path, does a synthetic test confirm which data is removed and whether the remaining content is permitted?

    • Cover files, not just prompts

      Do your controls inspect file uploads as well as typed text?

  4. Sanctioned AI adoption

    • Offer approved alternatives

      Have you sanctioned enterprise-grade options for the ChatGPT, Copilot, Gemini and Claude use cases employees already have?

    • Review account and service settings

      For each approved AI service and account type, have owners confirmed training use, identity, retention and processing-location settings?

    • Make approval fast

      Is there a well-known, fast route to request a new AI tool so employees do not route around IT?

  5. Incident readiness

    • Have a response plan

      Is there a documented plan for an AI-related data exposure, with named owners and timelines?

    • Test your detection

      Would your monitoring actually flag sensitive data pasted into an unsanctioned AI tool today?

    • Learn from near-misses

      Are past AI incidents and near-misses reviewed for root cause and fed back into controls?

  6. Device and identity foundations

    • Enrol devices

      Are endpoints under MDM or Intune so AI controls can be deployed and enforced at scale?

    • Centralise identity

      Is access to sanctioned AI tools governed through SSO, with Entra or a similar identity provider?

    • Account for unmanaged devices

      Do you know how much AI usage happens on BYOD and unmanaged devices, and is it in scope?

Download the checklist (PDF)

One A4 page, no email required. You can also print this section directly from your browser.

Go deeper

FAQ

Common questions

How is my Shadow AI risk score calculated?
Your answers add weighted points for organisation context, reported AI use and reported control gaps. The total is normalised to 0 to 100 and grouped into review-priority bands. It is an indicative priority score, not a measured probability of a breach.
Is the assessment free?
Yes. The assessment is completely free, takes about two minutes and shows your score and tailored recommendations immediately. You do not need to enter an email to see your result.
What do I get at the end?
You see your indicative 0 to 100 score, a tier and recommendations based on your answers. The number of recommendations varies. Your result remains visible without email; you can optionally request a follow-up.
How is this different from a compliance or maturity assessment?
This is a self-assessment based on your answers. It does not scan devices or AI accounts, measure live exposure, or establish compliance. Use the result to prioritise a scoped inventory and control review.
What is a Shadow AI risk assessment?
A Shadow AI risk assessment reviews unapproved employee AI use, sensitive-data exposure and the controls in place. This page provides a self-assessment of your reported context across eight questions, plus an ungated audit checklist. Validate the answers with an observed inventory and appropriate control tests; the questionnaire itself does not measure live activity.

Review the controls behind your answers

Bring a named AI app, your intended browser or desktop path and a synthetic prompt or file. Review policy responses, evidence and installation prerequisites with Aona.

Explore the guided trialBook a security demo