https://cpf-coaching.com/assets/ShadowAiReview-DzTQdv6Y.js

1import{j as e,r as d,a as p,B as k,b as N,S as j}from"./index-N_mbFD0L.js";import{m as g}from"./proxy-DtkzmSsg.js";import{S as A}from"./shield-check-axAjiri_.js";import{C as I}from"./circle-check-CAn9MDgd.js";import{T as S}from"./triangle-alert-BBa1m_UY.js";import{A as f}from"./arrow-right-DHWHsjE1.js";import{L as C}from"./lock-BiGD-fmx.js";import{C as P}from"./clock-CM9b4yvH.js";const m=[{id:"approved_tools",title:"Authorized Generative AI Tools",question:"How many generative AI tools has your organization officially approved for employee use?",options:[{value:"0",label:"0 approved tools",risk:!0},{value:"1-2",label:"1 to 2 approved tools",risk:!1},{value:"3+",label:"3 or more approved tools",risk:!1},{value:"unsure",label:"Not sure",risk:!0}],recommendation:{heading:"Establish a sanctioned AI registry",body:"Officially approve one or two enterprise-grade AI tools (such as ChatGPT Enterprise or Copilot) and block known shadow AI domains at the DNS level to force traffic into the secured tools."}},{id:"egress_monitoring",title:"Outbound Network Traffic Monitoring",question:"How do you currently monitor outbound traffic to AI and LLM services?",options:[{value:"none",label:"No monitoring",risk:!0},{value:"manual",label:"Manual log reviews",risk:!0},{value:"automated",label:"Automated monitoring and alerts",risk:!1},{value:"unsure",label:"Not sure",risk:!1}],recommendation:{heading:"Implement automated egress monitoring",body:"Configure your firewall or secure web gateway to flag and alert on data flows heading to unsanctioned LLM endpoints."}},{id:"cicd_permissions",title:"CI/CD and AI Agent Permissions",question:"How are permissions handled for your AI agents and CI/CD pipelines?",options:[{value:"broad",label:"Broad, unvetted permissions",risk:!0},{value:"scoped",label:"Scoped per task (least privilege)",risk:!1},{value:"none",label:"No AI agents in CI/CD yet",risk:!1},{value:"unsure",label:"Not sure",risk:!0}],recommendation:{heading:"Enforce least privilege for non-human identities",body:"Immediately audit all API keys and service accounts used by automated agents, scoping them down so a prompt injection cannot trigger a system-wide breach."}},{id:"training_policy",title:"Employee Training and Data Restrictions",question:"Do you have an AI Acceptable Use Policy that restricts what employees can enter into public models?",options:[{value:"none",label:"No policy",risk:!0},{value:"planning",label:"Planning to draft one",risk:!0},{value:"yes",label:"Policy in place and distributed",risk:!1},{value:"unsure",label:"Not sure",risk:!1}],recommendation:{heading:"Roll out an AI Acceptable Use Policy",body:"Draft and distribute a clear, one-page policy that explicitly defines which data classes (PII, source code, financial data) are prohibited from being entered into public models."}},{id:"auditor_proof",title:"Auditor Proof and Compliance Readiness",question:"If your auditor asked today, could you prove your AI controls are in place?",options:[{value:"no",label:"No",risk:!0},{value:"partial",label:"Partially",risk:!0},{value:"yes",label:"Yes, fully",risk:!1},{value:"unsure",label:"Not sure",risk:!1}],recommendation:{heading:"Establish continuous evidence collection",body:"Map your new AI controls directly to your upcoming SOC 2 or PCI DSS requirements, ensuring you have the real-time telemetry auditors now expect."}}];function _(t){const o=m.map(s=>{const n=s.options.find(a=>a.value===t[s.id]);return{id:s.id,title:s.title,question:s.question,answerLabel:n?n.label:"Not answered",flagged:n?n.risk:!1,recommendation:s.recommendation}});return{gaps:o.filter(s=>s.flagged).length,total:o.length,modules:o}}function E({plan:t}){const o=t.modules.filter(a=>a.flagged),s=t.modules.filter(a=>!a.flagged),n=()=>{window.dispatchEvent(new CustomEvent("openChat",{detail:{initialPrompt:`I just completed the Shadow AI Review and have ${t.gaps} of ${t.total} gaps flagged. I'd like to scope a vCISO engagement to close them.`}}))};return e.jsxs(g.div,{initial:{opacity:0,y:16},animate:{opacity:1,y:0},transition:{duration:.5},className:"ink-hairline rounded-2xl bg-ink-two overflow-hidden",children:[e.jsxs("div",{className:"ink-hairline-b px-6 py-7",style:{background:"linear-gradient(180deg, rgba(0,149,68,0.10), transparent)"},children:[e.jsxs("div",{className:"flex items-center gap-2 text-emerald-cpf text-xs font-semibold tracking-[0.3em] uppercase mb-3",children:[e.jsx(A,{className:"w-4 h-4"})," Your action plan"]}),e.jsxs("h2",{className:"font-display text-2xl md:text-3xl text-white tracking-tight mb-2",children:["We found ",e.jsx("span",{className:"text-amber-400",children:t.gaps})," of ",t.total," shadow AI gaps in your environment."]}),e.jsx("p",{className:"text-white/60 text-sm max-w-2xl",children:"Each gap below maps directly to a remediation we can scope together. Your answers essentially write the proposal."})]}),e.jsxs("div",{className:"px-6 py-6 space-y-3",children:[o.map((a,r)=>

1e.jsx("div",{className:"ink-hairline rounded-xl p-5",style:{background:"rgba(251,191,36,0.05)"},children:e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("span",{className:"mt-0.5 flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-amber-400/15 text-amber-400 font-display text-sm font-bold",children:r+1}),e.jsxs("div",{className:"flex-1",children:[e.jsxs("div",{className:"flex flex-wrap items-center gap-x-2 gap-y-1 mb-1",children:[e.jsx("h3",{className:"font-display font-semibold text-white text-[15px]",children:a.title}),e.jsxs("span",{className:"text-[11px] px-2 py-0.5 rounded-full bg-amber-400/10 text-amber-300 border border-amber-400/20",children:["Your answer: ",a.answerLabel]})]}),e.jsx("div",{className:"text-emerald-cpf text-sm font-semibold mb-1",children:a.recommendation.heading}),e.jsx("p",{className:"text-white/70 text-sm leading-relaxed",children:a.recommendation.body})]})]})},a.id)),s.length>0&&e.jsxs("div",{className:"pt-2",children:[e.jsx("div",{className:"text-white/40 text-xs uppercase tracking-[0.25em] mb-2",children:"On track"}),e.jsx("div",{className:"grid sm:grid-cols-2 gap-2",children:s.map(a=>e.jsxs("div",{className:"flex items-center gap-2 text-sm text-white/55",children:[e.jsx(I,{className:"w-4 h-4 text-emerald-cpf shrink-0"}),e.jsx("span",{children:a.title})]},a.id))})]})]}),e.jsxs("div",{className:"ink-hairline-t px-6 py-6 flex flex-col sm:flex-row items-start sm:items-center gap-4 justify-between",children:[e.jsxs("div",{className:"flex items-start gap-2 text-white/55 text-sm max-w-md",children:[e.jsx(S,{className:"w-4 h-4 text-amber-400 mt-0.5 shrink-0"}),e.jsx("span",{children:"A 30-minute scoping call maps these gaps to your environment and timelines."})]}),e.jsxs("button",{onClick:n,className:"inline-flex items-center gap-2 rounded-full px-6 py-3 text-sm font-semibold text-white shadow-[0_8px_24px_-8px_rgba(0,149,68,0.7)] whitespace-nowrap",style:{background:"linear-gradient(180deg, #00A84C, #007A38)"},children:["Book a scoping call ",e.jsx(f,{className:"w-4 h-4"})]})]})]})}function q(){const[t,o]=d.useState({}),[s,n]=d.useState(null),[a,r]=d.useState(""),[u,h]=d.useState(!1),v=m.every(i=>t[i.id]),w=async()=>{if(!v){r("Please answer all five questions to generate your action plan.");return}r(""),h(!0);const i=_(t);try{N.analytics.track({eventName:"shadow_ai_review_submit",properties:{gaps:i.gaps,total:i.total}})}catch{}h(!1),n(i)};return s?e.jsx(E,{plan:s}):e.jsxs("div",{className:"space-y-6",children:[e.jsxs("div",{className:"flex items-center gap-2 text-emerald-cpf text-xs font-semibold tracking-[0.3em] uppercase",children:[e.jsx(p,{className:"w-4 h-4"})," Five questions, instant action plan"]}),e.jsx("div",{className:"space-y-5",children:m.map((i,b)=>e.jsxs("div",{className:"ink-hairline rounded-2xl bg-ink-two p-5",children:[e.jsxs("div",{className:"flex items-baseline gap-3 mb-3",children:[e.jsx("span",{className:"text-white/30 font-display text-sm font-bold",children:String(b+1).padStart(2,"0")}),e.jsxs("div",{children:[e.jsx("h3",{className:"font-display text-white font-semibold text-[15px] mb-0.5",children:i.title}),e.jsx("p",{className:"text-white/55 text-sm",children:i.question})]})]}),e.jsx("div",{role:"radiogroup","aria-label":i.title,className:"grid sm:grid-cols-2 gap-2 mt-3",children:i.options.map(l=>{const x=t[i.id]===l.value;return e.jsx("button",{type:"button",role:"radio","aria-checked":x,onClick:()=>o(y=>({...y,[i.id]:l.value})),className:`text-left rounded-lg px-4 py-2.5 text-sm border transition-all ${x?"border-emerald-cpf bg-emerald-cpf/10 text-white":"border-white/10 bg-ink text-white/65 hover:border-white/25 hover:text-white"}`,children:l.label},l.value)})})]},i.id))}),a&&e.jsx("p",{className:"text-amber-300 text-sm text-center",children:a}),e.jsx("div",{className:"flex flex-col items-center",children:e.jsx(k,{onClick:w,disabled:u,className:"rounded-full px-8 py-6 text-base font-semibold text-white shadow-[0_8px_24px_-8px_rgba(0,149,68,0.7)]",style:{background:"linear-gradient(180deg, #00A84C, #007A38)"},children:u?"Building your plan...":e.jsxs(e.Fragment,{children:["Get my action plan ",e.jsx(f,{className:"w-4 h-4 ml-2"})]})})})]})}const c="https://cpf-coaching.com",R=[{icon:p,value:"14 to 22",label:"unsanctioned AI tools per 100 employees"},{icon:C,value:"Nearly 0",label:"with formal approval"},{icon:P,value:"5 minutes",label:"to see your exposure and fix plan"}],M={"@context":"https://schema.org","@graph":[{"@type":"Service","@id":`${c}/shadow-ai-review#service`,name:"Shadow AI Risk Review & Generative AI Governance",description:"A structured shadow AI assessment for SMBs. Identifies unsanctioned generative AI tool adoption, intellectual property leakage risks, and delivers an executive AI governance policy roadmap.",provider:{"@id":`${c}/#organization`},url:`${c}/shadow-ai-review`,areaServed:{"@type":"Country",name:"United States"}},{"@type":"FAQPage","@id":`${c}/shadow-ai-review#faq`,mainEntity:[{"@type":"Question",name:"What is Shadow AI in an organization?",acceptedA

1nswer:{"@type":"Answer",text:"Shadow AI refers to the unauthorized or unmonitored use of generative artificial intelligence tools (such as ChatGPT, Claude, Copilot, or AI browser extensions) by employees for business tasks without formal IT security review, data privacy agreements, or governance approval."}},{"@type":"Question",name:"How do SMBs manage Shadow AI risks?",acceptedAnswer:{"@type":"Answer",text:"Managing shadow AI requires three core steps: 1) conducting an inventory audit of AI tools in active use, 2) establishing an Acceptable AI Use Policy that clearly defines prohibited sensitive data types, and 3) implementing fractional vCISO oversight to approve enterprise-tier AI tools with zero-data-retention agreements."}}]}]};function $(){return e.jsxs("div",{className:"min-h-screen bg-ink text-white",children:[e.jsx(j,{title:"Shadow AI Review & Governance for SMBs | CPF Coaching",description:"Free 5-minute Shadow AI review for SMB leaders. Identify unsanctioned AI tool usage, data privacy leakage risks, and get an immediate remediation action plan.",keywords:"shadow AI review, shadow AI risk assessment, generative AI governance for SMBs, unauthorized AI tools in workplace, AI acceptable use policy",url:"https://cpf-coaching.com/shadow-ai-review",type:"website",schema:M}),e.jsx("section",{className:"relative pt-28 pb-12 ink-hairline-b",children:e.jsx("div",{className:"max-w-[1080px] mx-auto px-6",children:e.jsxs(g.div,{initial:{opacity:0,y:16},animate:{opacity:1,y:0},transition:{duration:.6},className:"max-w-3xl",children:[e.jsxs("div",{className:"flex items-center gap-2 text-emerald-cpf text-xs font-semibold tracking-[0.3em] uppercase mb-4",children:[e.jsx(p,{className:"w-4 h-4"})," Shadow AI Review"]}),e.jsxs("h1",{className:"font-display tracking-tight text-4xl md:text-5xl leading-[1.02] mb-4",children:["Find the AI tools your team is using ",e.jsx("span",{className:"text-emerald-cpf",children:"without permission."})]}),e.jsx("p",{className:"text-white/60 text-lg max-w-2xl mb-8",children:"Five questions. Zero friction. Your answers map directly to a personalized remediation plan that frames a vCISO scoping call."}),e.jsx("div",{className:"grid grid-cols-1 sm:grid-cols-3 gap-4",children:R.map(t=>e.jsxs("div",{className:"ink-hairline rounded-xl bg-ink-two p-4",children:[e.jsx(t.icon,{className:"w-4 h-4 text-emerald-cpf mb-2"}),e.jsx("div",{className:"font-display text-white text-lg font-bold",children:t.value}),e.jsx("div",{className:"text-white/45 text-xs leading-snug",children:t.label})]},t.label))})]})})}),e.jsx("section",{className:"py-12",children:e.jsx("div",{className:"max-w-[860px] mx-auto px-6",children:e.jsx(q,{})})}),e.jsx("section",{className:"py-10 ink-hairline-t",children:e.jsx("div",{className:"max-w-[860px] mx-auto px-6 text-center text-white/40 text-xs",children:"The Shadow AI Review is a self-assessment, not legal or consulting advice. Nothing is stored unless you choose to book a consult."})})]})}export{$ as default};