AI Discovery & Risk Assessment
Shadow AI Discovery, AIBOM Generation & Enterprise AI Risk Baselining
Know what AI your enterprise runs, where it touches sensitive data, and where you stand against ISO/IEC 42001 and NIST AI RMF. Combines automated SaaS/CASB discovery with expert analysis to inventory models, agents, and supply chains.
Standardized 5-Phase Technical Methodology
We engage enterprise stakeholders across business lines, engineering, IT, legal, and risk to map declared AI initiatives, pilot projects, fine-tuned models, and vendor integrations.
- Cross-functional scoping interviews with business product managers and ML engineers
- Establishing designated ownership for credit, fraud, underwriting, and customer-facing models
- Initial classification of internal vs. public-facing AI applications
- Review of existing IT asset registers and third-party SaaS contracts
Our discovery tooling interrogates proxy logs, web gateways, CASB solutions, and IdP event streams to uncover unapproved employee use of public GenAI tools, coding copilots, and AI-enabled SaaS.
- Parsing proxy and egress gateway logs for traffic to public GenAI endpoints
- IdP audit for unvetted OAuth grants and API authorizations to third-party AI extensions
- Identifying unsanctioned browser copilot plugins on corporate workstations
- Analyzing prompt data flows to assess potential source code or PII exposure
We generate structured AI Bills of Materials (AIBOM) for critical internal systems, documenting foundational base models, training datasets, fine-tuning checkpoints, dependencies, and vector stores.
- Cataloging model weights, HuggingFace/GitHub repository origins, and license terms
- Documenting training and evaluation datasets, vector databases, and embeddings
- Mapping software dependencies, quantization packages, and inference runtimes
- Verifying data provenance and compliance with DPDP Act 2023 data fiduciary obligations
Every identified AI use case is assigned a risk tier based on decision criticality, data sensitivity, and autonomy. We baseline the enterprise against the 5-stage AI security maturity model.
- Algorithmic impact scoring: assessing potential for financial, legal, or reputational harm
- Gap analysis against ISO/IEC 42001 38 Annex A controls and NIST AI RMF functions
- Evaluating agent autonomy levels and human-in-the-loop validation mechanisms
- Benchmarking posture across Foundational, Controlled, Visible, Assured, and Improving stages
We deliver an executive readout to leadership, summarizing top AI risks, unmanaged shadow AI liabilities, and providing a prioritized roadmap for Stage 2 access controls and policy gates.
- Board-ready executive presentation highlighting top exposure areas
- Technical debrief with engineering leaders on critical model remediation
- Defining concrete exit criteria and formal sign-off of the AI System Register
- Delivering a scoped proposal for Stage 2 Access & Secrets Control implementation
Technical Scope & Deep Architectural Analysis
Standard Operational Verification Checklist
- Establish cross-functional discovery workshop schedule with IT, legal, and ML teams
- Connect discovery sensors to proxy, CASB, and firewall telemetry feeds
- Compile comprehensive AI system register with designated business and technical owners
- Generate standardized AIBOMs documenting models, datasets, and runtime dependencies
- Classify every AI use case onto the 4-tier risk heatmap (Unacceptable, High, Medium, Low)
- Baseline current enterprise posture on the 5-stage AI Security Maturity Model
- Deliver executive readout and secure sign-off on the formal AI Register
Key Deliverables Included
- Enterprise AI System Register with named business and technical owners
- Standardized AIBOMs (AI Bill of Materials) for priority models and training pipelines
- Risk-Tiered AI Use-Case Heatmap (Low, Moderate, High, Unacceptable Risk)
- Maturity Baseline Assessment Dossier across the 5 stages (Foundational to Improving)
- Executive Readout Presentation for Board, CISO, and Legal Leadership
Regulatory Alignment
Schedule Scoping Consultation
Directly configure this service scope and receive our agreed Rules of Engagement with Quick Response SLA.
Request Scoping Consultation