AI security · Governance

Shadow AI discovery.

Your staff already use AI. Some paste contracts, customer lists and source code into free tools you have never heard of. We find every AI tool in use and what goes into it, then help you decide what to allow, what to replace and what to block.

Get a fixed-price quote
Inventory of every AI tool in useAI bill of materials (AI-BOM)A policy people will actually follow
discovery · sample● demo
  1. FOUND Customer list pasted into a free AI chatbot
  2. FLAGGED AI note-taker joined a board meeting
  3. FOUND Browser plug-in reads every web page
  4. FIXED Approved AI workspace rolled out
  5. PASSED Code assistant on a company account
In plain words

Shadow AI means AI tools staff use without approval: free chatbots, browser plug-ins, AI note-takers, code assistants. Discovery finds them through network and SaaS logs, browser extensions, expense claims and a short anonymous staff survey, then traces what data flows into each one. You get an AI inventory and AI bill of materials, a risk ranking and a simple policy that offers safe alternatives instead of a blanket ban.

Duration
1–2 weeks
Aligned with
ISO 42001 · CERT-In guidance
Output
AI inventory and AI-BOM
Pricing
Fixed fee
How it happens

How a contract ends up in someone else’s AI.

  1. Your teamA manager needs a summary, fast

    A 40-page vendor contract, a deadline, and a free AI tool a friend recommended.

  2. Your dataThe whole contract is pasted in

    Prices, client names and penalty clauses, from a personal account the company cannot see.

  3. Your systemsThe tool keeps it

    Many free plans store prompts and may use them to improve the service. Your company has no contract with this vendor.

  4. AttackerYou cannot get it back

    There is no record, no deletion route and no breach alert. If the contract held personal data, it may now be a DPDP problem.

  5. The fixThe fix

    An approved AI workspace with a business contract, blocks on the riskiest tools, and a one-page guide that explains the difference.

Bans on their own do not work

Samsung restricted staff use of generative AI tools in 2023 after engineers pasted internal source code into a public chatbot. Bans like that tend to push use onto personal phones, where you see even less.

What works is a safe, approved option that is just as easy to use, plus clear rules on what never goes into any AI.

How it works

Find it, trace it, decide, explain.

  1. Day 1

    Scope

    Agree which logs, systems and teams to include, and how staff will be told.

  2. Days 2–6

    Discover

    Network, DNS and proxy logs, SaaS and identity logs, browser extensions, expense claims and an anonymous staff survey.

  3. Days 5–8

    Trace data

    For each tool: who uses it, what goes in, where it is stored, and whether it trains on your data.

  4. Days 8–9

    Decide

    Allow, limit, replace or block, with a safe alternative for each popular use.

  5. Day 10

    Roll out

    Policy, staff guide and a short briefing, so people know what is allowed and why.

The AI inventory

What we record for every tool.

  • Tool and vendor

    Name, owner, plan (free or business) and where the vendor is based.

  • Users and teams

    Who uses it, how often and for which jobs.

  • Data that goes in

    Customer data, personal data, source code, contracts, financials.

  • Data handling

    Whether prompts are stored, for how long, where, and whether they train the vendor’s models.

  • Access and plug-ins

    Which accounts, drives or inboxes the tool connects to.

  • Decision

    Allowed, allowed with limits, replace or block, with the reason written down.

What you get

A clear picture, and rules people follow.

HANULSECShadow AI discovery report CLIENTSample · professional services firm SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical1High3Medium6Low4 AI INVENTORY · AI-BOM POLICY LIVE Sample layout, not client data
  • 01
    AI inventory

    Every AI tool found, who uses it and for what.

  • 02
    AI bill of materials

    Models, vendors, plug-ins and data flows for each approved AI system.

  • 03
    Risk ranking

    Which tools to allow, limit, replace or block, and why.

  • 04
    AI use policy

    A short, plain policy staff can follow without a lawyer.

  • 05
    Staff guide and briefing

    A one-page do and don’t guide and a 45-minute session.

Who it is for

Say yes to AI, safely.

  • Companies preparing for ISO/IEC 42001 or an AI governance audit
  • Firms answering customer questionnaires that ask “which AI tools do you use?”
  • Regulated businesses expected to keep an inventory of AI assets
  • Leaders who want to say yes to AI safely, rather than ban it blindly
  • Teams getting ready for the DPDP Act’s full enforcement in May 2027

What is an AI-BOM?

An AI bill of materials is an ingredients list for AI: which models, datasets, plug-ins and vendors each AI system uses. CERT-In’s 2025 audit guidelines and its 2026 AI security guidance both refer to AI-BOMs, alongside the software bill of materials (SBOM) many teams already keep.

See our guide to CERT-In rules and AI.

Standards

Evidence for AI governance.

ISO/IEC 42001AI management systems
CERT-InDirections and audit guidelines
DPDP Act 2023With the DPDP Rules 2025
NIST AI RMFWith the GenAI profile
ISO/IEC 27001Information security
EU AI ActRegulation (EU) 2024/1689

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What is shadow AI?
Shadow AI is any AI tool used for work without the company’s approval or knowledge: free chatbots, AI note-takers that join meetings, browser plug-ins, code assistants, translation and image tools. The risk is not the tools themselves but the data that goes into them without a contract or controls.
Q02Do you monitor individual employees?
No. We use company systems and logs you already own, plus a voluntary anonymous survey. We report on tools and types of data, not on named people, unless you specifically ask for an investigation under your own HR policy.
Q03What is an AI-BOM?
An AI bill of materials lists the models, datasets, plug-ins and vendors each AI system uses, much like a software bill of materials lists code libraries. It helps you answer auditors and customers, and react fast when a model or vendor has a problem.
Q04Should we just ban public AI tools?
A ban alone usually pushes use out of sight. A better approach is to provide an approved tool with a business contract, block the highest-risk tools, and give staff simple rules on what never goes into any AI.
Q05How does this help with ISO 42001?
ISO/IEC 42001 expects you to know which AI systems you use and to manage their risks. The inventory, AI-BOM and policy are the first evidence an auditor will look for.
Q06How long does it take?
One to two weeks for most organisations, depending on size and how many log sources are available.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings