Guides
Run the Shadow-AI assessment
This guide covers what your team does during the assessment.
Before you start
- Agree and sign the NDA and data processing agreement before sharing client data.
- Name a sponsor and an IT contact.
- Agree which data sources you will export.
Step 1: Export your data
Export what you have. You do not need everything:
- DNS, proxy or firewall logs for the period agreed in the assessment scope.
- The list of third-party apps connected to company mail and files.
- A device software list, if you have device management.
Export instructions for each agreed source are reviewed with your IT contact.
Step 2: Share it securely
Send exports through the agreed secure channel. Do not email raw logs.
Step 3: Staff survey (optional)
Send the short anonymous survey to staff. It explains why people use the tools.
Step 4: Readout
msharti presents the scored report: tools found, likely data exposure and the top findings.
Step 5: Data deletion
After delivery, exported data is deleted within the period agreed in the DPA, and deletion is confirmed in writing.