An AI security readiness assessment is a fixed-scope review of your systems and data before AI tools go live, whether that is an off-the-shelf AI assistant or an app built for your business. We check identity and access, sharing and permissions, sensitivity labels, tool choice and AI policy, then give you a prioritised fix list and a baseline to measure against.
Why check before switching AI on?
AI tools answer questions using everything a person already has permission to open. They do not create new access, but they remove the effort of looking. A spreadsheet shared with "Everyone" three years ago, a board folder with the wrong group on it, a contract in a public Teams channel: each can appear in an answer to a routine question.
Oversharing is common. It is normal, and it is fixable. The point of the assessment is to find it, fix the worst of it and set the controls before the tools arrive, not after.
What does the assessment check?
- Identity and access. Multi-factor authentication (MFA) on every account, admin roles kept to the few who need them, conditional access, and leavers' accounts closed, so AI only acts for the people it should.
- Sharing and permissions. SharePoint sites, OneDrive folders and Teams channels shared more widely than intended, including "Everyone" and anonymous links, ranked by how sensitive the content is.
- Sensitivity labels and data classification. Whether confidential, personal and client data is labelled, and whether those labels carry encryption or data loss prevention rules. A label on its own is a tag; it only protects data when it carries one of those.
- Tool choice and first users. Which AI tools fit which roles, so you buy licences that earn their keep and start with the teams most likely to use them well.
- AI policy and governance. Whether there is a written policy on which AI tools are approved, what data may go into them and who decides, and whether it needs aligning with ISO/IEC 42001.
What do you get?
- A readiness report. The findings, grouped by severity, in plain language a board can read.
- A prioritised fix list. What to change first, what can wait, and who should do it, whether that is your team, your IT provider or Conosco.
- A baseline. How many files are overshared, which accounts lack MFA and which controls are missing, so the gain can be shown as a number once the fixes are done.
- A rollout recommendation. Which roles should get which AI tools first, and what training they need.
- A policy starting point. A short AI use policy you can adopt as it is or build on.
How long does it take and what does it cost?
It is a fixed-scope piece of work with a fixed fee, agreed before we start. Most of the work is done by Conosco; your team's time is a short kick-off, a few questions along the way and a readout of the findings. Nothing in your systems is changed during the assessment.
Who does the work?
Conosco's security team, the same team that runs Conosco's managed security services and reviews every Conosco.AI build before it goes live. Conosco was founded in 2002 and is certified to ISO 27001 and Cyber Essentials Plus. You can use Conosco.AI alongside your existing IT provider.
What happens after the assessment?
You can act on the fix list yourselves, or we do it: that is the Foundations stage of our approach. Once the foundations are in place, Adoption covers choosing and licensing the right tools for each role, setting them up securely and training people to use them. If you are not sure where AI would pay back at all, the one-week diagnostic looks at where time goes across the whole business first.