Free assessment · 15 minutes · No software to install
Your team is already using AI. Do you know what they are pasting into it?
The Shadow AI Audit gives you 24 questions, a risk score, and a plain-English report showing exactly where your business data is exposed, and the fastest way to lock it down.
No credit card. No sales call required. Your report lands in your inbox in under a minute.
It did not start with a decision. It started with a deadline.
Someone on your team was up against it. A twelve-page client contract, twenty minutes to summarise it, and a free chatbot tab already open in the next window.
They pasted it in. It worked brilliantly. Nothing bad happened.
So they did it again the next week. Then the quote. Then the tender response. Then the spreadsheet with every client's contact details, because reformatting it by hand would have taken all afternoon.
Nobody was being reckless. Nobody was hiding anything. They were doing their job faster, using a tool that is free, that is on their phone, and that nobody ever told them not to use.
And that is the problem. You cannot manage what you cannot see. Right now there is almost certainly a list of tools, accounts and documents that describes how AI is genuinely being used inside your business. You have never seen that list. Neither has your insurer.
The Shadow AI Audit builds that list. In fifteen minutes.
What you get
A report about your business. Not a generic PDF about AI.
Your answers generate a bespoke document. Two businesses that take this audit get two genuinely different reports.
Your AI Readiness Score, out of 100
A single number, plus one of four risk bands (Exposed, Patchy, Controlled, or Ready) so you know within thirty seconds how much trouble you are in.
Your top five risks, ranked
Not a list of everything that could theoretically go wrong. The five things that are actually true of your business, each with a plain-English explanation of what it could cost you.
A benchmark against businesses your size
Because whether this is normal is the first question every owner asks, and the answer changes what you do next.
A fill-in AI Use Register
The document you hand to a client, an auditor, or an insurer when they ask what tools you use and what data goes into them. Most businesses cannot produce this. You will have it.
A one-page Acceptable Use Policy
Editable, written in language your team will actually read, ready to circulate this week. Not forty pages of legalese nobody opens.
A 30-day remediation checklist
Sequenced by impact, with each item marked as something you can do yourself or something that needs a specialist. Most of it, you can do yourself.
Your three best automation opportunities
The flip side. Your answers reveal where manual work is quietly eating your margin, and which of those jobs AI could take off your hands safely.
Outcomes
By Friday, you will be able to say:
How it works
Three steps. Fifteen minutes.
Answer 24 questions
One at a time, plain English, no jargon. Roughly fifteen minutes. You can leave and come back.
See your score instantly
Your risk band and headline findings appear the moment you finish. No waiting.
Get the full report by email
The complete document, including your policy template and register, arrives immediately.
Straight answers
The things owners tell us first.
We are too small for this to matter.
Small is precisely the problem. Large companies have blocked these tools at the network level and issued policies. Small businesses have not, which is why the exposure is concentrated in businesses like yours. And your clients' data is no less sensitive because you have eleven staff instead of eleven hundred.
We have banned AI, so we are fine.
A ban you cannot enforce is a ban that pushes usage onto personal phones and personal accounts, where you have no visibility at all. Businesses with a stated ban frequently score worse than businesses with no policy, because the usage is still happening. It is just hidden. Take the audit and find out which one you are.
This is just going to try and sell me something.
Yes, we would like to work with you. We are not going to pretend otherwise. Here is the deal: the report is complete and useful on its own, and most of the 30-day checklist is marked DIY because most of it genuinely is. If your score comes back healthy, we will say so and you will never hear a sales pitch from us.
I do not have fifteen minutes.
Then take it in two sittings. Your progress saves. Or consider what the alternative timeline looks like: finding out during a client security questionnaire, an insurance renewal, or a breach. Fifteen minutes now is the cheapest version of this conversation you will ever have.
I will have to discipline someone over what I find.
Almost certainly not, and that is the point of doing it now. Nobody has broken a rule that did not exist. This audit is designed to be run as a fact-finding exercise, not a witch hunt. The report is written so you can share it with your team as a here-is-what-we-are-putting-in-place document.
I do not want more marketing emails.
You will get five over about a fortnight, each one attached to something practical. Unsubscribe is in every email and works instantly. We do not sell or share your details.
Questions
Answered.
Is this really free?+
Yes. No card, no trial, no locked sections in the report.
How long does it take?+
Around 15 minutes. Progress saves if you need to stop.
Do I need to be technical?+
No. If you can name the software your business uses, you can complete this. There are no trick questions.
What information do you collect?+
Your answers, your name, your email, and your business name and size for benchmarking. We do not ask for client data, documents, or system access. Nothing connects to your network.
Is this a Privacy Act compliance assessment?+
No, and it is important to be clear about that. This is a practical risk and readiness review based on how your business actually operates. It is not legal advice and does not certify compliance with any standard. If you need formal compliance advice, speak to a lawyer, and this report will make that conversation considerably shorter.
What if my score is terrible?+
Then you have just done the most valuable fifteen minutes of work in your quarter. Every risk in the report comes with a fix, and they are sequenced so the highest-impact items come first.
Can I share the report with my team or my board?+
Please do. It is formatted for A4 print and designed to be forwarded.
Do I have to talk to anyone?+
No. There is an option to book a review call if you want one. Ignore it and the report is still yours.
Who is behind this?+
TechGurus, an Australian AI and IT consultancy based in Sydney, working with small and medium businesses. Contact: 02 8004 7215.
Start the audit
Fifteen minutes for a clear picture.
The list exists whether you look at it or not.
You can build that list deliberately, in fifteen minutes, or have it assembled for you later by a client's security questionnaire, an insurer, or a breach notification. One of those is a lot cheaper than the other.
Prefer to talk it through first? Get in touch