You already run on AI. The risk is a different shape.
You already run on AI. Some of it acts on its own.
That's a valid posture. Nothing here asks you to slow down.
That's a valid posture. Early adopters take risks to be out front. Nothing here asks you to slow down.
More tools than most businesses, so more places your data lives. Agents with permission to act — write, send, delete — not just answer. Code that AI wrote, running in production. Connections between tools, with permissions nobody has looked at in months. The risk isn't that AI is in the business. It's that the surface is wider and the controls are still the ones a smaller footprint needed.
Nothing about how you use it. The survey shows you what your people actually do with the tools — including the ones you don't know about. Your board sizes each exposure in your dollars and asks you to decide: accept it, on the record, or address it. For many of your rows, accept will be the honest answer — and now it's written down, which is what an insurer or an investor will ask for.
Neither is the default. Accepting is a signed record — yours, dated, in your own words. Addressing opens what we do, what gets referred out, and what you can do yourself.
Your risk board, after the survey and your numbers. Every row asks for a decision and records the one you make.
What's actually risky about the setup I have?
Breadth and permission: more places your data lives, agents that can write, send or delete, code nobody read, connections whose permissions nobody has looked at in months.
Do I have to change how we work?
No. The survey shows what your people do — including the tools you don't know about — and the board asks you to decide per risk.
Why would I accept a risk instead of fixing it?
Because some of them are worth carrying, and a carried risk that's written down and dated is what an insurer or an investor asks for.
What does it cost?
Survey, report and board free. Validation of a control is $100 per risk or $400 for the board; the rest is quoted.
The record: the tools are already acting; the record is what makes that defensible. Each risk you accept or address is written down, dated, in your AI workspace — what an insurer or an investor asks for first.
Why the record matters