Why assess now
Three questions, answered in five business days
Visibility
What AI is actually observable in use across your organization?
Risk
Which evidenced weaknesses matter most?
Action
What should you fix first, why, by whom, and how do you verify the fix?
What we evaluate
Seven workstreams, one bounded assessment
Every tier uses the same methodology. Findings are evidence-based and limited to approved systems, available telemetry and representative samples; discovery is not a guarantee that every AI service is found.
AI discovery and shadow-AI exposure
Sanctioned and observable unauthorized AI use, reconciled against your inventory.
Data security and information exposure
Data controls for AI processing, AI-connected repositories and vendor retention settings.
Identity, access and agent security
Least-privilege, credentials, approvals and revocation for people, services and AI agents.
AI application and integration security
Representative AI applications, integrations and trust boundaries, reviewed non-destructively.
AI governance and policy readiness
Ownership, approvals, exceptions, vendor diligence and oversight of AI adoption.
Monitoring, detection and resilience
Whether AI activity and incidents are observable, attributable and containable.
Risk analysis and remediation
Each finding scored with evidence, impact, owner and verification criteria.
Methodology references: NIST AI RMF 1.0 and AI 600-1, OWASP LLM and agentic AI guidance, MITRE ATLAS, and ISO/IEC 42001 principles, used as crosswalks and not as certifications.
Deliverables
Five deliverables, every tier
Every tier receives the same five deliverables plus one executive readout. What changes by tier is how much is reviewed.
Executive AI Security Assessment Report
Scope, key findings, coverage, business implications and priorities.
AI Asset and Exposure Register
Discovered applications, agent samples, owners, evidence and usage classifications.
AI Risk Register
Findings with severity, likelihood and impact, evidence, owners and verification criteria.
AI Governance and Security Scorecard
Domain-level maturity with coverage and evidence confidence.
30/60/90-Day Remediation Roadmap
Immediate containment, tactical hardening, and governance and architectural improvements.
Timeline
Five business days from readiness to readout
The five days are elapsed business days. They begin once the required access and discovery inputs are available.
Day 1 — Initiation and discovery
Confirm access and scope, collect inventory and documentation, begin approved read-only collection.
Day 2 — Security exposure
Shadow AI, data flows, permissions, identity and selected integrations.
Day 3 — Governance and agents
Agent trust boundaries, policy, oversight, monitoring and response.
Day 4 — Validation and reporting
Correlate evidence, validate priority findings, draft the report after quality review.
Day 5 — Executive readout
Independent quality pass, final package and executive presentation.
Tiers and scope
Four tiers, sized by organization and scoped by tier
Coverage is capped by tier. Broad discovery may surface more items than the in-depth review caps; the caps govern verified detailed review. Work beyond a tier’s scope requires a bounded sample, a change order or a new statement of work.
| Essential | Business | Professional | Enterprise | |
|---|---|---|---|---|
| Users | 1–100 | 101–500 | 501–2,500 | 2,501+ |
| Primary identity tenants | 1 | 1 | 2 | 3 |
| Administrative / telemetry sources | 2 | 3 | 5 | 6 |
| AI apps reviewed in depth | 3 | 5 | 8 | 10 |
| Agents / integrations sampled | 2 | 4 | 8 | 12 |
| Stakeholder interviews | 1 | 2 | 3 | 4 |
| Executive review | 45 min | 45 min | 60 min | 60 min |
Scope boundaries
What this assessment is, and is not
A point-in-time, bounded, remote-first assessment of approved systems. It is not an attestation, certification or legal opinion.
- Not a penetration test, red team or exploitation exercise, and not incident response or forensics.
- Not an exhaustive endpoint, network or cloud audit, a source-code review, or a model bias, fairness or accuracy evaluation.
- Not a SOC 2, HIPAA, CMMC or ISO/IEC 42001 compliance certification.
- Does not include remediation, agent deployment or ongoing managed security operations, and does not guarantee that every shadow-AI service or vulnerability is found.
Talk through your situation
Book a short consultation to walk through your environment, the frameworks that apply to you, and a sensible first step. No pitch deck.
Prefer to start smaller? Contact us or start with the SENTRY AI Security QuickScan.