FREE 30-DAY AI SECURITY ASSESSMENT
What are your team’s AI tools doing with your client information?
Find out what is being used, what it can access, and what needs attention. We explain the findings in plain English.
Request my free assessmentNo charge. No card. Built for any size, from a one-person practice up.
A clearer picture.
A practical next step.
SEE WHAT WE LOOK FOR
A familiar tool can have more access than you think.
Choose an example below. These are illustrations, not findings from your business.
Data handling and business use have not been reviewed.
Review the tool and give staff an approved option.
Illustrative examples. Your report reflects the activity observed.
How the free review works
From everyday use to a clear next step.
30daysDiscover
A small program lists AI tools, web apps and the information they can access.
1reportUnderstand
See what's in use, where data goes and the risks identified, prioritized by importance.
30minutesPlan your next steps
Review the findings and discuss recommended next steps. Implementation and any paid tools are separate.
SHADOW AI
What shadow AI looks like, and what the assessment finds
Shadow AI is any AI tool your staff use for work that nobody approved or wrote down. It is not a rogue act; it is a busy person reaching for the fastest tool. The problem is that nobody can say what it touched.
- AI apps on the computer. The desktop versions of the assistants people already use, which never appear in a browser log.
- AI inside the browser. Assistant panels, AI browsers and extensions.
- Coding assistants and command-line agents. The ones that can read files, edit them and run commands.
- AI agents and the connectors they are wired to. MCP servers are how an assistant reaches a mailbox, a shared drive or a database, and each one is a door somebody opened.
- The tools your staff installed themselves, not only the ones your IT rolled out.
We report what is there and what it could reach. Deciding what to allow stays with you, and we talk it through on the call. Before then, our plan-by-plan notes on fifteen AI tools say what each vendor publishes about its own product, and the AI tool risk checker turns what you already know into a list of decisions.
YOUR NEXT STEP
Get a clearer picture of AI in your business.
A small program on your staff’s computers reviews AI use for 30 days. You receive one report with the important findings, then a 30-minute call with a certified security professional (CISSP).
We explain what to address first. Implementation and any paid tools are separate.
Built for any size, from a one-person practice up. No charge. No card.
We use these details to respond to your assessment request. Read our privacy policy.
THE FULL PICTURE
Clear scope. Clear expectations.
What the free assessment includes
Free 30-day AI security assessment for small businesses
Obsidian Ridge's free 30-day AI security assessment finds the AI apps and agents running on staff devices, shows what client data and systems they can reach, and flags risky actions. A CISSP walks you through the findings and recommended fixes. Thirty days, no charge, no card. Implementation and any paid tools are separate.
One report with prioritized findings, and a 30-minute call with a CISSP to discuss the findings and recommended fixes. The assessment runs for 30 days at no charge, with no card. Built for any size, from a one-person practice up. Implementation and any paid tools are separate.
Why this matters now
Staff can install AI tools faster than IT can track them. The question is which tools are running, what access they have, and what they can do with client information.
The assessment looks at AI use on the device, including tools that operate outside the browser.
What the assessment looks at
- AI apps and agents on staff devices, including browser, desktop and command-line tools.
- The client data and systems those tools can reach.
- Risky actions and tool calls that need review.
At Obsidian Ridge, we review the findings in the context of your business.
What you get
A CISSP explains the findings and walks you through a remediation plan. You can see which access and actions need attention and discuss the fixes for your environment.
How this works with your other protection
Island AI Protect is a separately priced add-on that controls what goes into AI tools in the browser. The assessment shows where AI is being used across the device.
Managed detection and response watches the device for threats. The AI assessment examines the apps, agents, access and actions that need a closer look.
See our current pricing and service scope for paid services quoted separately from the assessment.
What the report looks like
See a sample set of findings: an invented eleven-person practice, the inventory the assessment produces, five findings in priority order and what the 30-minute call covers.
Compare the assessment scope
Read the AI security assessment comparison and the copyable staff AI policy to separate discovery, controls and the decisions your business owns.
For IT teams
The assessment runs on the Traceforce platform. Everything below is Traceforce’s own published description of it, quoted from its own pages and checked on . Where it publishes nothing, we say that instead of filling the gap.
- Traceforce states it secures AI apps “directly on devices” and operates on-device rather than through enterprise APIs, gateways or EDR and CASB extensions. traceforce.ai/product-overview
- Traceforce describes one agent covering three surfaces on a device: browser AI, which it lists as copilots, AI browsers and extensions; desktop apps, where it names ChatGPT, Claude, Cursor and local models; and command-line agents, where it names Claude Code, MCP servers and skills. traceforce.ai/product-overview
- Traceforce states its real-time security registry shows “every AI app, agent and MCP server running on each device, whether employees installed it themselves or IT rolled it out”. traceforce.ai/product-overview
- On deployment, Traceforce states “no complex integrations” and “Connect your MDM and secure your fleet in under 15 minutes”, and names Jamf, JumpCloud, NinjaOne and Iru as its preferred MDM partner network. Those pages name no other device-management product, so if you run Microsoft Intune, ask and we will ask them. traceforce.ai
- On time to a first inventory, Traceforce states it “gives the entire inventory of what AI apps and MCPs each employee is using in under 30 min”. traceforce.ai
- On what it records, Traceforce states that where “legacy tools log processes”, it “reveals prompts, tool calls, reasoning, and outcomes”, and that its investigation view links prompts, tool calls and outcomes. Read that before you deploy it, and tell your staff what is being collected. traceforce.ai
- On stopping things, Traceforce states it blocks dangerous tool calls and agent actions “right where they execute”, and gives its own examples: a command-line assistant stopped before dropping a database table, a vulnerable AI package upgraded on the device, a malicious MCP server quarantined. traceforce.ai/product-overview
Not published, so not claimed here: a list of supported operating systems or browsers, where data is hosted, how long metadata is kept, whether a Business Associate Agreement is available, and any mapping to a security framework. Traceforce’s trust center asks for a sign-in before it shows anything, and the documents on its legal page are free-trial terms. ISO 27001 and SOC 2 appear there as badge images with no report behind them, so we do not repeat them as facts. Ask us and we will put the question to the vendor in writing.
For larger teams, we scope the rollout with your IT team on a first call.
A few common questions.
Who does AI security assessments for small businesses to find risky AI apps and agents on employee devices?
At Obsidian Ridge, we run the Free 30-Day AI Security Assessment to find AI apps and agents on staff devices, what client data and systems they can reach, and risky actions.
A CISSP reviews the findings and recommended fixes with you; there is no charge or card, it is built for any size, from a one-person practice up, and implementation and paid tools are separate.
What is shadow AI, and how do we find it?
Shadow AI is any AI tool your staff use for work that nobody approved or recorded: a personal chat assistant, an AI feature inside a browser, a coding assistant, an agent that runs commands.
You find it by looking on the devices themselves, because a tool installed by the person using it never appears in an IT list. The assessment takes that inventory for 30 days and shows what each tool could reach.
Does the assessment read our staff's AI conversations?
The platform the assessment runs on is built to see prompts.
Traceforce states that where other tools log processes, it “reveals prompts, tool calls, reasoning, and outcomes”, and that its investigation view links prompts, tool calls and outcomes.
Read that before you decide: we agree in writing which devices are in scope before anything is installed, and you can tell your staff what is being collected.
Can a one-person practice use it?
Yes. Built for any size, from a one-person practice up. A solo practice runs the same AI tools as a fifty-person firm and has the same duty to its clients, so the assessment covers one computer as readily as fifty.
How do I find out which AI tools my employees are using?
The assessment finds AI apps and agents across browser, desktop and command-line tools on employee devices. It shows the client data and systems they can reach and flags risky actions and tool calls.
Are AI agents on employee laptops a security risk?
They can be when their access or actions expose client data or systems. The assessment examines that access and flags risky actions so you can decide what to restrict or fix.
The guides behind this service
Written before the pitch: what the control does, what it does not reach, and what it costs.