Free · no sign-up

Shadow AI checklist

Shadow AI is the AI your team uses without the company knowing or controlling it. Measure how much there is and where the risk is.

Visibility

You have an inventory of the AI tools your team uses (ChatGPT, Copilot, Gemini, Claude, image generators, transcribers). ISO 42001 A.4.2

You can see on the network or proxy which AI services company devices connect to. ISO 27001 A.8.16

You know which apps you already pay for (CRM, email, office, support) turned on AI features and which data they use. ISO 42001 A.10.3

You control the browser extensions and AI add-ins installed on devices. ISO 27001 A.8.19

Rules and approval

There is a written, communicated AI use policy: allowed tools, forbidden uses and who to ask. ISO 42001 A.9.2

A new AI tool goes through approval (security, legal) before it is used with company data. ISO 42001 A.6.2.2

AI agents or automations that read email, files or act on systems have least-privilege permissions and an owner. ISO 42001 A.9.4

Data and contracts

Pasting personal or customer data, passwords or source code into unapproved AI tools is forbidden (and monitored). Ley 1581 · ISO 42001 A.7.2

Approved tools have a contract or business plan that prevents training models on your data. ISO 42001 A.10.3

You checked in which country each AI vendor processes data and whether that requires consent or extra safeguards. Ley 1581 (transferencia internacional)

There are data leakage controls (DLP, labels, blocking) that also cover AI sites. ISO 27001 A.8.12

People and control

The team was trained on AI risks: data leaks, hallucinations, deepfakes and AI-generated phishing. ISO 42001 A.4.6

AI output that reaches customers or important decisions is reviewed by a person before it is used. ISO 42001 A.9.3

Work AI runs on corporate accounts (company sign-in), not personal accounts. ISO 42001 A.3.2

🔒 Everything runs in your browser or is discarded after the response. We do not store what you type.

Want a full review of your company?

These tools show what is visible from the outside. A T.I. RESCUE pentest or audit covers the rest: systems, people and processes.

Talk to a specialist See our AI and machine learning audit service →

More tools

Password generator and strength checker

Generate a strong password in one click, or type yours to see how long it would hold. Nothing leaves your browser.

Try it →

Was I hacked? Guided check

Tick what is happening to you. At the end you get the risk level and the steps in order, based on your answers.

Try it →

Domain security checker

Passive checks only (DNS, TLS and HTTP headers), the same ones any mail server or browser performs. Graded A to F.

Try it →

What is my IP?

This is the address your connection uses on the internet, and what a site sees when you visit.

Try it →

ISO 27001 self-assessment

Answer about what exists and works today, not what is planned. It is the short version of the GAP assessment we run with our clients.

Try it →

ISO 42001 self-assessment (AI governance)

ISO/IEC 42001 is the certifiable standard for managing artificial intelligence. Answer about what exists and works in your company today.

Try it →

AI system risk classifier

Pick what you use AI for and where you operate. We show the risk level and the obligations that would apply. Guidance only, not legal advice.

Try it →

AI acceptable use policy generator

Fill in the details and get an AI acceptable use policy ready to review with your legal team. It is built in your browser.

Try it →

RTO, RPO and downtime cost calculator

Enter your numbers: the result is the cost of your last outage and the targets a continuity plan should set.

Try it →

Help desk cost per ticket

With five numbers you already have, you will know whether your support is expensive, overloaded or both.

Try it →

CVSS 3.1 calculator

Pick each metric and see the score instantly. The same formula we use in our pentest reports.

Try it →

IPv4 subnet calculator

Enter an IP and its prefix. You can also split the network into equal subnets for VLANs or segmentation.

Try it →

Cloud speed test

Not your ISP's test: it measures the real path to a server in Europe, like when you use Microsoft 365, a VPN or a cloud system. Close downloads and video calls before measuring.

Try it →

Email header analyzer

Ideal for that email “from the boss” or “from the bank” that doesn't add up. Everything is analyzed in your browser.

Try it →

Phishing simulator: would you have fallen for it?

Attacks on companies almost always start with a message like these. Two minutes, no sign-up.

Try it →

DNS, MX and blacklist lookup

The tool we use when “the email never arrives”: it shows what other servers see of your domain and why they might reject it.

Try it →

SSL/TLS certificate checker

An expired certificate takes down your website, email and your customers' trust the same day. Check it in seconds.

Try it →