Shadow AI Risk Audit
Your team is leaking regulated data into ChatGPT. Right now.
A fixed-fee Shadow AI Risk Audit finds every place CUI, client files, or sensitive data is flowing into public AI tools, and gets it documented before it becomes a failed assessment or a lost contract.
The "just paste it into ChatGPT" habit is an audit finding waiting to happen.
Your employees are copy-pasting CUI, contracts, client files, and internal data into ChatGPT, Copilot, and Gemini every day. No log. No policy. No visibility into what left your boundary, or whether the provider's terms even fit your contract classification.
That's an unprovable compliance gap sitting inside your current contracts. CMMC Level 2 assessors will start asking about it as the rule lands in November 2026, and "we didn't know" isn't an answer that keeps the work.
The fix
One audit. A clear map of your AI exposure, and the paperwork to close it.
The Shadow AI Risk Audit is a fixed-fee, one-time engagement that maps every public AI tool your team is using, identifies where regulated or sensitive data is crossing into those tools, and hands you a plain-English remediation plan plus the documentation an assessor expects. Two to three weeks. No recurring retainer. Scope confirmed in writing before any work begins.
- AI data-flow map: every tool in use and exactly where sensitive data crosses your boundary into it.
- Risk-ranked findings: what's exposed, how badly, and what to fix first.
- Remediation checklist: a concrete, prioritized path to close each gap.
- Draft Acceptable Use Policy for AI tools: a one-pager your team will actually follow.
- SSP and POA&M language: findings mapped to NIST SP 800-171 so the work feeds your compliance package directly.
Founding-client pricing
Start with a free call. The audit is a flat fee, no hourly surprises.
AI Risk Call
Free
A 30-minute call to walk through what AI tools your team is using and where your most exposed data flows are. You leave with at least one actionable finding at no charge. If the audit isn't the right fit, we'll tell you on the call.
Shadow AI Risk Audit
from $1,500 fixed
Founding-client rate for organizations under 25 seats. No overages. The full data-flow map, risk-ranked findings, remediation checklist, AI use policy, and SSP and POA&M language, scoped in writing before work starts.
This founding-client rate exists to validate the offer; it won't hold past the first five engagements. ThinkCodec runs one active engagement at a time, which is how the fixed-fee model holds. Booking the free call costs nothing and commits you to nothing.
How it works
Free AI risk call
30 minutes. We map what AI tools your team uses and your most exposed data flows. You leave with at least one actionable finding, no charge, no pitch.
Scope, then audit
If it's a fit, we confirm scope and price in writing first. The engagement runs two to three weeks: tool inventory, data-flow mapping, risk ranking, and documentation.
Hand it to an assessor
You get the full package (data-flow map, risk-ranked findings, remediation checklist, AI use policy, and SSP and POA&M language), ready to show.
Why ThinkCodec
The methodology is in the open.
Open methodology
Our reference architecture for secure AI on Microsoft 365 is public on GitHub. Review the approach before you book. It's not a black box.
Maps straight to your compliance package
Fixed-fee, plain English. Findings map to the 110 NIST SP 800-171 controls so the audit feeds your SSP and POA&M, not a slide deck.
Straight answers
The questions you're already asking.
We already have an IT policy that covers AI tools.
Most policies were written before ChatGPT existed. They name approved software lists, not AI data flows. The audit checks what's actually happening, not what the policy says should happen.
We're not sure we even handle CUI.
If you hold defense contracts or subcontracts, or handle data marked FOUO, export-controlled, or client-confidential, you likely do. The free call takes 30 minutes to confirm.
We can't afford a consultant right now.
The founding-client rate is $1,500 fixed, scoped before any commitment. Weigh that against a failed CMMC assessment, or a prime routing CUI work to a competitor who got assessed first.
How do you manage capacity?
Fixed-fee means we only take engagements we can fully deliver, one at a time. The model structurally prevents overcommitment, which is exactly what you want from someone who'll have eyes on your sensitive data flows.
We're not at the CMMC deadline yet.
Level 2 requirements start appearing in contracts around November 2026, and the 110 controls take four to six months to stand up from scratch. The time to find the AI exposure gap is before your next contract mod arrives, not after.
How do we know the findings will be accurate?
The methodology is built on NIST SP 800-171 control 3.13.1: monitor and control communications at external boundaries, which is exactly where data crosses into a public AI provider. The reference architecture is public on GitHub. Review the approach before you book.
Find out where your data is going, before an assessor does.
Book a free 30-minute AI Risk Call. No pitch, just a straight read on your AI exposure and at least one finding you can act on today.
Book a free AI risk call