Shadow-Agent Audit

Your team already runs agents. We map what each one can do, R1 to R4.

A shadow AI audit finds agents employees already use and maps what each can access and do. Sophizo produces an inventory, R1 to R4 risk ranking, a one-page use policy and a human readout. The work uses read-only access and does not require monitoring software. See governed AI teams.

Book the audit See the Agentic AI Team
  • 1 to 2 weeks
  • Read-only access
  • No monitoring software
A flashlight reveals one unfamiliar key with an orange tag among rows of labeled office keys.

THE PROBLEM

Your team already brought its own AI to work.

of knowledge workers use AI at workWork Trend Index, May 2024of AI users bring their own AI tools to workWork Trend Index, May 2024organizations reported a breach due to shadow AIBreach-cost research, Jul 2025higher average breach cost for organizations with high levels of shadow AIBreach-cost research, Jul 2025

Of organizations that reported a breach of AI models or applications, 97% did not have AI access controls in place (Breach-cost research, 2025)

ILLUSTRATIONAgents connected to company systemsFive company systems connect to the company. A few orange agent markers represent unknown access, this is conceptual, not quantitative.EmailFilesCRMCalendarFinanceYour company

You cannot govern what you cannot see.

THE AUDIT

What you get.

  1. 01

    Inventory

    Every AI tool and personal agent touching company data, who uses it, what it can access.

  2. 02

    Risk ranking

    Every tool and agent placed on the R1 to R4 scale by data sensitivity, autonomy and cost of an error.

  3. 03

    One-page AI use policy

    What is allowed, what needs approval, what is banned.

  4. 04

    A 30-minute readout

    The three fixes to make this month.

A SHARED RISK LANGUAGE

Every agent gets a place on the scale.

A hand sorts white cards into four columns, the last marked orange.

R1 · Low

Reads, summarizes and drafts for internal use only.

Nothing leaves the business and nothing changes in a system of record.

Ranked by data sensitivity, autonomy and cost of an error.

How we assign R1 to R4

A POLICY PEOPLE CAN USE

Make the rules clear enough to follow.

AI USE POLICY01 / 01
ALLOWED
NEEDS APPROVAL
BANNED
PLAIN LANGUAGE · ONE PAGE
Tangled cords on one side, a single page in the middle, and neatly coiled, tagged cords on the other.

One page.Plain English.Your team can follow it.

A QUICK CHECK

Do you have shadow agents?

Four quick questions. Your answers stay on this page.

  1. 01People here use AI tools the company did not buy.
  2. 02Someone has connected an AI tool to company email or files.
  3. 03We have no written AI use policy.
  4. 04I could not list every AI tool with access to our data today.

FIXED SCOPE. FIXED PRICE.

Start with a clear picture.

Small business

$1,500 fixed

For teams up to 50 people.

Read-only access

Book the audit
MID-MARKET

Mid-market

$5,000 fixed

For teams of 50 to 500 people.

Read-only access

Book the audit
Credited in full toward Agentic AI Team setup or the Governance Sprint.

GOOD TO KNOW

Questions owners ask.

01Do you need access to our systems?

Read-only admin views and a short staff survey. We do not install monitoring software.

02Will staff get in trouble?

The audit is about access, not blame. Most shadow AI exists because people are trying to work faster.

03What happens after?

Most clients either move the useful agents under governance (Agentic AI Team) or formalize policy (Governance Sprint).

MAKE ACCESS VISIBLE

Make access visible.

Start with an audit. Leave with a clear inventory, a risk ranking and a policy your team can use.

Book the audit

Related reading