A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Shadow AI is the use of AI tools by employees without the organization's knowledge, approval, or oversight, the AI-era version of shadow IT. It most often looks like staff pasting sensitive data into public chatbots or wiring unsanctioned models into workflows. The risk is not the tools themselves but the absence of any control over what data reaches them and what comes back.
The first deliverable is visibility. You cannot govern or secure what you cannot see, so a shadow AI effort starts by discovering which tools and data flows already exist rather than by writing policy in the abstract.
From there it becomes a governance problem that an acceptable use policy and a short approved-tools list largely solve. Most leakage comes from convenience, so the durable fix is making the safe path the easy one.
traztech delivers a shadow AI audit for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Shadow AI surfaces the first time someone asks which AI tools the company actually uses and nobody can answer. By then staff have usually been feeding customer data, code, or contracts into public models for months. The starting point is a shadow AI audit.
The reflex to ban everything tends to drive the usage further underground. The workable response is an inventory, a short acceptable use policy, and sanctioned tools that are good enough that people do not need to go around them.
Because data leaves your control without any record. Information pasted into a public model may be retained, used for training, or exposed, and you cannot assess a risk you do not know exists.
Find out what is actually being used, publish a clear acceptable use policy, and provide sanctioned alternatives. Enforcement without a usable sanctioned option just hides the behaviour.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.