An AI inventory + AI-BOM
One row per system: owner, business purpose, the models and tools it uses, the data classes it touches, the keys it holds. The bill of materials your security function already keeps for everything else.
Consulting · AI governance
Find the AI you don't know you're running.
You can't govern what you can't see. Most organizations have more AI in production than any one person can name — models pulled for a test and never cleaned up, tools wired to a shared key, agents with no budget or owner. We inventory all of it, risk-tier it, and hand you the list of what to govern first.
Done, not theorized
The first honest scan of our own platform turned up 6.9 GB of model weightsno registered system claimed, three systems sharing a master key, and fourteen keys with no budget or rate limit.
Every one harmless on its own. Together: a governance blind spot the size of a small language model. We run that same discipline on your environment — and it almost always finds something. It's the fastest, lowest-risk way to know where you actually stand.
What you get
The shadow-AI findings
The models, tools, and keys nobody registered — pulled for a test and never cleaned up, wired to a shared credential, running with no budget or owner. The things that don't show up in any diagram.
A govern-first list
Everything risk-tiered T0–T3 and sorted by exposure, so you know exactly which handful of systems to bring under control this quarter — not a 200-item backlog.
How the engagement runs
- 01
Instrument & sweep
We route model access through a single choke point and sweep the environment — the only way to find what can't authenticate is to make authentication mandatory.
- 02
Inventory & AI-BOM
Every system that surfaces gets a row: owner, purpose, models, tools, data, keys. Unregistered systems become visible precisely because they can't get in.
- 03
Risk-tier it
Each system is placed T0 (read-only, low blast radius) through T3 (moves money or touches regulated data), so control effort follows risk instead of spreading evenly.
- 04
The govern-first list
You get the ranked list of what's highest-risk and unowned, plus the fastest path to bring each under control. The natural on-ramp to a full governance assessment.
Fixed scope, fixed fee, measured in weeks. It stands alone — and it's the on-ramp to thegovernance assessment if you want to close the gaps it finds.
Who it's for
Security, platform, and engineering leaders who suspect they have AI in production they can't fully account for — and want the map before the incident.
Why work with us
We built this tooling for our own platform and published the method. You get the scan from the people who wrote it, not a generic questionnaire.
Know what you're actually running.
A scan is the fastest way to a real picture — and a short list you can act on.