Sample findings
What the report looks like, on an invented practice
Lintonbury Family Dental does not exist. It is an invented eleven-person dental practice, used here to show the shape of a free 30-day AI security assessment: the inventory it produces, five findings in the order we would work through them, and what the 30-minute call covers. No real client, report or finding appears on this page.
Request your own assessmentThe invented practice
Eleven people: two dentists, a hygienist, three clinical assistants, three at the front desk, a practice manager and a part-time bookkeeper. One location, one shared drive, a practice-management portal in the browser all day, and nobody whose job is IT. The kind of practice that runs AI tools because they save twenty minutes, not because anyone decided to.
What the inventory showed
Thirty days of quiet observation on eleven computers. Seven AI tools, five of which nobody had approved.
| Tool | Category | Installed by | People using it |
|---|---|---|---|
| ChatGPT, desktop app | General assistant | The people using it | 6 of 11 |
| An AI panel inside the browser | Browser AI | Came with the browser | 9 of 11 |
| A meeting notetaker that joins calls | Transcription | The people using it | 3 of 11 |
| Claude, desktop app | General assistant | The people using it | 2 of 11 |
| A coding assistant on the practice-manager's laptop | Coding assistant | The person using it | 1 of 11 |
| Two MCP servers wired to that assistant | Agent connector | The person using it | 1 of 11 |
| A grammar helper as a browser extension | Writing aid | IT, two years ago | 11 of 11 |
The table says who installed each tool, because that is what the platform reports. It does not say which account somebody signed in with or which plan they are on — nothing published claims that — so where it matters, we ask on the call. Our plan-by-plan notes on the AI tools themselves are the other half of that question.
Five findings, in the order we would work through them
Each one says why it matters, what fixes it, and roughly what it costs you in effort. Implementation and any paid tools are separate from the assessment.
1. An agent connector could read the whole shared drive
Why it matters. One of the two MCP servers was configured with access to the practice's file share, which holds patient correspondence. Nobody had set it up to read patient files; it was set up to read a folder, and the folder was a parent of everything.
The fix. Point the connector at a single working folder, or remove it. Then decide in writing who may add a connector at all.
Effort. Under an hour, once somebody owns the decision.
2. A coding assistant could run commands that change records
Why it matters. The assistant on the practice-manager's laptop was allowed to run shell commands without a confirmation step. The risk is not malice; it is an assistant doing exactly what it was asked, to the wrong database.
The fix. Turn on the confirmation prompt for commands that write or delete, and keep the assistant away from anything holding patient data.
Effort. Minutes on the device, plus a short conversation about what the role actually needs.
3. A credential turned up in an assistant's working context
Why it matters. An access key for a cloud account appeared in what the assistant was completing from. A key in a prompt is a key in somebody's logs.
The fix. Rotate that key, then stop keeping credentials where an assistant reads files. A password manager or a secrets store, not a text file next to the project.
Effort. An hour, mostly spent finding every copy.
4. An AI package on two devices had a known vulnerability
Why it matters. A library two of the AI tools depend on was three versions behind, with a published advisory against the version in place.
The fix. Update it on both devices. This is the kind of thing the platform can do on the device without a script.
Effort. Same day, no downtime.
5. A notetaker was recording clinical calls to a personal account
Why it matters. Three staff had installed a meeting notetaker themselves and signed in with whatever account they already had. Recordings and transcripts of calls that mention patients were being kept outside the practice.
The fix. Decide whether notetaking is allowed at all. If it is, approve one tool on an account the practice controls, and remove the rest.
Effort. A week, because this one is a policy decision before it is a technical change.
What the 30-minute call covers
- The findings in plain English, in the order above, and what each one could actually cost this practice.
- Which ones you can close yourself this week, and which need a decision before a change.
- The two or three AI tools worth approving properly, so staff stop reaching for whatever is nearest.
- What stays open, and what it would take to close it. We would rather leave a known gap written down than tidy it away.
A real report is laid out differently from this page: it is a document from the platform the assessment runs on, with its own sections and charts. What carries over is the substance — an inventory, findings in priority order, and a fix beside each one.
Built for any size, from a one-person practice up. No charge, no card.
Start my free assessmentBack to the AI security assessment, or read the scope comparison.