CultureAI

Free AI Risk Assessment

Your workforce is using AI. See what's really happening.

A free two-week assessment that catalogues every AI your people use, shows what data is leaving your organisation, and measures the impact of switching on guardrails.

Live at 50 sensors. Findings on day 7.

ProvisionSetup
Sensors liveDay 0
Interim findingsDay 7
DebriefDay 14

Built in the UK. Trusted globally.

Octopus Energy
ITS
Tatton
Annexus Health
Octopus Energy
ITS
Tatton
Annexus Health
app.culture.ai· Assessment reportDay 14
Overall exposure
High
Recommended actions
6
Credentials & secretsCritical Risk
Customer PIIHigh Risk
Source codeHigh Risk
Financial dataMedium Risk
Report ready · debrief with your team booked

How it works

From provisioning to debrief in two weeks

  1. 1

    Before day 0: provisioning

    We create your tenant, invite your users and apply secure defaults. Your admin activates the account, accepts the terms and shares the install page. The clock does not start until your sensors are live.

  2. 2

    Day 0: deploy and go live

    Roll out the desktop and browser sensors. The assessment starts automatically once 50 are reporting in: no scheduling, no manual switch. You get a confirmation email, the live activity view and your full commercial pack the same day.

  3. 3

    Day 7: interim findings, first guardrails

    Your interim briefing covers the shadow AI in use, the prompts and uploads carrying sensitive data, and the credentials leaving the business. We then recommend one or two universal policies you can switch on in a click.

  4. 4

    Day 14: debrief

    The assessment closes and we run your debrief with your team in the room: every AI app risk-scored, your data-exposure picture, identities and MFA status, and the risk reduction since your policies went live.

  5. 5

    Days 14 to 21: full access

    A further seven days of unrestricted access to the platform, so your team can keep working with the data.

  6. 6

    Days 21 to 28: grace period

    Warnings at seven days and 24 hours, plus your data export and sensor-removal steps. On day 28 the tenant is deleted. No extensions.

The assessment

Understand AI risk in your organisation

Track real interactions with AI tools, understand what data is being shared, and identify risk based on actual user behaviour, not assumptions.

Which AI tools are actually in use

Every AI app, account and browser extension your people use, including shadow AI and personal accounts.

What data is being shared

Prompts and uploads classified in around 500 milliseconds, as they happen, not hours later.

Where risk is introduced

Based on real user behaviour and interaction patterns.

The impact of switching on guardrails

Turn on a prebuilt policy and measure the drop in exposure before the assessment ends.

Leave with every AI app risk-scored, a clear picture of your data exposure, and audit-ready evidence for the EU AI Act, GDPR, NIST AI RMF, ISO 42001 and SOC 2.

app.culture.ai· AI Risk Assessment LIVE
AI apps found
118
Active AI users
187
Risky events
42
Admin credentials pasted into ChatGPT
chatgpt.com · 2 min ago
Critical Risk
customer_list.csv uploaded to Gemini
gemini.google.com · 14 min ago
High Risk
Source code shared with Claude
claude.ai · 26 min ago
High Risk
Meeting notes summarised in Notion AI
notion.so · 1 hr ago
Medium Risk
Assessment window
Day 9 of 14

Coverage

Surface risk across

ChatGPTGeminiMicrosoft CopilotClaudePerplexityCustom and internal LLMsand 10,000+ more AI apps

What you’ll need

Everything required to run a real-world assessment

1

50 or more users

Covered by the desktop and browser sensors. The assessment starts automatically once 50 are live, giving a fair, representative view of AI usage.

2

An admin to provision

Someone to activate the tenant, accept the terms and switch on at least one prebuilt policy on day 7.

3

The right people at the debrief

The people who need to act on the findings, in the room for the day-14 debrief.

What teams discover

Most teams are surprised by what the assessment surfaces

Real experiences from organisations uncovering how AI is actually being used.

“The biggest surprise wasn't the tools, it was the behaviour. People were pasting things into AI tools that they absolutely shouldn't have been.”
CISO
Financial Services
“We were keen to roll out AI more widely, but the assessment showed pretty quickly that the team was already using it beyond our visibility.”
DPO
Legal Firm
“Honestly, we just wanted to sanity check what was going on. Within a week, it was obvious we had gaps we hadn’t even considered.”
Head of IT
Public Sector
“We knew people were using AI, but we had no idea how widespread it was or what was actually being shared. That was the worrying part.”
Director of Cyber
Healthcare Provider