how much of your company's AI use can you actually see?
A 30-minute call with a cybersecurity practitioner. You get our 18-question checklist ahead of time, while on the call we discuss what it surfaced across six areas of AI exposure - and you leave with suggested next moves.
Not a demo, not a discovery call, but an actual consultation.
Working with identities managed by:
.svg.png){kind=logo}
of employees still have access to a previous employer's account
2022
•
Beyond Identity
of account-compromise attacks are blocked by MFA
2023
•
Microsoft
of breaches involved the human element
2026
•
Verizon DBIR
most AI use at work is invisible by design
71% of connections to GenAI tools happen through personal, non-corporate accounts, therefore organizations have no visibility into 89% of AI usage in their environment.
And 64.5% of activity on personal and free-tier AI accounts is business use - company data, personal account.
None of this shows up in your SSO dashboard. That's the point of this review: before you buy tools or write policies, find out what you can and can't see.
sources:
LayerX Enterprise GenAI Security Report 2025;
Harmonic Security AI Usage Index, May 2026
Former employees still have the keys. Contractors and leavers keep authenticating months after they left. 83% of former employees keep access to at least one company app after leaving (Beyond Identity).
Your highest privilege sits behind a password alone. Admin accounts run without MFA, and the use of stolen credentials was involved in 36% of breaches (Verizon DBIR 2026). A shared admin login is worse, because when something happens, you cannot say who was behind it.
Nobody owns the service accounts. Technical accounts created for forgotten projects still hold broad access, assigned to no one and reviewed by no one.
Access outlived the job. A role change added new permissions and removed none, so people carry access several jobs deep.
This is the layer to see first, before you spend any money on a pentest, a compliance certification, or an identity platform.
You cannot fix, certify, or defend access you cannot see.
MyWayClinic could not say who had access.
In 7 days, they had the full picture
Like most healthcare providers that grew quickly, MyWayClinic ran on a stack that had expanded faster than the systems governing it.
Access was managed by hand. People joined, changed roles, and left, and the directory was kept roughly current, but nobody could say with confidence who could reach what across every connected application.
In healthcare, where patient data raises the stakes on every account, that uncertainty is the thing that has to be solved first.
I'd always worried whether the company was secure but had no idea where to start. Now I know exactly what to change and how.
Worth doing every so often, like a car service, just to feel safe.
CEO, MyWayClinic
We ran the access scan. We connected to MyWayClinic's existing identity provider in read-only mode, with no agents installed and no changes to the environment.
Over 7 days we mapped every account, OAuth grant, admin role, and service identity, then interpreted the data into a prioritized risk map rather than a raw export.
MFA coverage was at 12.9%. The large majority of accounts could be reached with a password, including accounts with elevated access.
Stale and over-privileged accounts that no longer matched the people or roles behind them.
Gaps in the offboarding path where access in connected apps survived beyond the directory.
This is the layer to see first, before you spend any money on a pentest, a compliance certification, or an identity platform.
You cannot fix, certify, or defend access you cannot see.
one read-only connection
Accessing your identity provider with YeshID is enough to map the access surface. Best fit is Google Workspace or Entra ID.
Okta works with a known limit and it does not expose OAuth apps.
Identity and Access
Every account in your directory, with its security state: MFA, activity, and account type.
Admin roles and least privilege: who holds Global Administrator, and whether they should.
Ghost accounts: former employees and contractors still active, cross-referenced with your HRIS.
Shared and service accounts that hold access with no owner.
Identity sprawl, the same person spread across several uncoordinated accounts.
MFA coverage across the directory.
SaaS Security and Governance
OAuth-connected apps using your Google or Microsoft identities, and the scopes they hold.
Apps with role-data APIs we can read: Stripe, GitHub, AWS including IAM Identity Center, HubSpot, and similar.
find out who has access, before an auditor or an attacker does
Most first conversations start with not quite knowing what you have or where to begin. That's normal.
Tell us what's going on and what prompted the conversation:
an upcoming audit, something that happened, a client requirement, or just a sense that things have gotten messy.
We can take it from here!
+48 783 762 997
julian@unshadowit.com
