Do you know which AI tools your team is using right now?
Most owners do not, and the answer is usually more than they expect. The risk is not the technology. It is company information leaving the building through tools nobody approved.
What we usually find
- Free accounts on consumer AI tools, paid for by nobody and governed by no one
- AI note-takers quietly sitting in customer and internal meetings
- AI features already switched on inside software you pay for
- Customer data, contracts, and financials pasted in to save time
What you get
- An inventory of every AI tool in use and the data it touches
- A written AI use policy your team can actually follow
- A one-page employee guide and a staff training session
- A tool approval process and a vendor due-diligence checklist
- Everything mapped to the NIST AI Risk Management Framework
How the four weeks work
Four weeks covers a team using off-the-shelf AI assistants and the AI features already built into software you pay for. If your business is building its own AI agents, or running them across several departments, the inventory and the review work take longer and we scope it before we start.
Find out what’s in use
We talk to your team and build an inventory of every AI tool in play, who uses it, and what data it touches.
Set the rules
We define what data can never go into a public AI tool, and sort current uses into permitted, permitted with conditions, and prohibited.
Write it down
A plain-English AI use policy, a one-page employee guide, a tool approval process, and a vendor checklist for AI features in software you buy.
Roll it out
A 45-minute staff session that explains the rules without lecturing, plus a leadership briefing on what we found.
Building AI agents, not just using AI tools?
Everything above governs the AI your team uses. Different work is needed once your business starts putting agents into production — software that takes actions on its own, calls other systems, moves data, and makes decisions without someone approving each step.
An agent is not a tool somebody opens. It is an account with credentials and permissions, running without a person watching. Most of the questions you would ask about a new employee with that much access — who approved this, what can it reach, who is accountable, how would we know if it misbehaved — have no answer yet in most organizations.
A register of every agent you run
Who owns it, what it was built to do, which systems and data it can reach, what it is allowed to do without a human, and when it gets reviewed again. You cannot govern what nobody has written down.
Review before production, not after
Security checkpoints built into how agents get developed and released, with a defined set of criteria an agent has to meet before it goes live and a named person who signs it off.
Threat models that produce requirements
We work through how each high-risk agent could be misused or manipulated, then turn that into specific, testable control requirements rather than a document nobody opens again.
Knowing when something goes wrong
What to log, what should raise an alarm, and how to spot an agent behaving outside what it was approved to do — before it becomes an incident somebody has to explain.
What we work from
The NIST AI Risk Management Framework and ISO/IEC 42001 for the program itself, and the OWASP guidance on risks specific to large language model and agentic applications for the technical control requirements. Published references, so your decisions are defensible to an auditor, a customer, or an insurer.
Where we stop
We define what adversarial testing an agent needs and review what the testing found. We do not perform offensive testing ourselves, and we will help you select someone who does. Same independence that applies everywhere else here — we do not sell the tools, and we do not sell the remediation.
Start with a free AI exposure check
A 30-minute conversation that produces a rough inventory of the AI tools in use at your company. No cost, and no obligation to go further.
Book your free exposure checkVantical Risk provides cybersecurity advisory services, not legal advice. Questions about how a specific regulation applies to your business should go to your attorney.