AI Usage & Shadow-AI Exposure Review – Find the AI Tools Your Business Actually Uses

Your staff are using more AI tools than your policy covers. This measures the gap.

The AI Usage & Shadow-AI Exposure Review finds the AI actually in use on a computer — installed AI applications, browser extensions that can read every page, AI service keys left in files, model servers running locally and, only if you opt in, a count of visits to AI websites — then sets what it measured against six questions about your rules for AI. Measured usage and self-reported governance are scored separately and never blurred together. Nothing leaves the machine while it runs: the only connections it opens are to the computer itself.

What it checks

• AI applications installed for this account, and AI browser extensions — including which ones can read every page you open
• AI service keys (OpenAI, Anthropic, Google AI and others) left in code, configuration and shell files
• AI model software running locally, and whether it is reachable from your network
• Exported chat transcripts, prompt libraries and training data sitting in files; optionally, a count of visits to AI sites — a count only, never a page title or address
• Six governance questions: policy, customer data in AI tools, vendor review, code review, approval and inventory
• Every measurement is for this user account and this computer, and the report says so

What you get

• A written PDF report emailed back to you, typically within one business day.
• Every finding rated Critical / High / Medium / Low, with measured findings and self-reported answers kept separate.
• The headline your policy needs: how many AI tools are in use, and how many of them the policy covers.
• An executive summary mapped to the NIST AI Risk Management Framework, with OWASP LLM Top 10 and ISO/IEC 42001 clause references alongside, that you can hand to a client, an insurer or your board.
• A "what was checked" appendix that states the limits of the scan honestly.
• Reporting built to CompTIA Security+ and PenTest+ practice standards.

Who it's for

Business owners and managers who suspect AI is being used with customer data and want a measured answer before writing a policy — or before a client asks. There is no other way for a small business to get this without an enterprise platform or a consultant.

Requirements

• Windows 10 or Windows 11
• No administrator rights needed — it checks this user account's AI usage, not the whole machine
• No internet connection needed for the checks; only to send the report
• Optionally, a folder of your own code or documents to include
• About 6 minutes, including the six questions

What this is not

QuickScan is detection and advisory only. It never reads the content of a conversation, a prompt or a page; the optional browser-history check counts visits and records nothing else. It never contacts an AI service, never uses a key it finds, and changes nothing. Mapping to a framework is not an audit against it: the report is not a certification, an audit or an attestation of ISO/IEC 42001 or anything else.

One-time purchase. No subscription, no auto-renewal. Your report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.