The assessment above asks how your business uses AI, where that AI gets its information, and what controls sit between the two. It takes about three minutes, asks for no personal information, and requires no access to your systems. You get an overall risk read, the specific gaps behind it, the compliance frameworks your usage touches, and the Hardshell guides that address each gap. Selections and scores are recorded anonymously so we can see how businesses are actually putting AI to work.
Enterprise AI meets sensitive data in three places, and each one fails differently. Training and fine-tuning encode content into model weights, where it can later be extracted by anyone with query access. An AI knowledge base retrieves from internal documents at query time and returns whatever the index will surface, regardless of who is asking. Third-party AI platforms move data into systems you do not control.
Guardrails at the application edge do not address any of these directly, because the exposure is created upstream of the prompt. That is the distinction behind secure RAG, and the reason a risk assessment starts with your data rather than your models.
Owners, operators, IT and security leads, and compliance staff at small and mid-size businesses putting AI to work on company data, including firms in healthcare, financial services, legal, manufacturing, and government contracting. You do not need to know your architecture to answer the questions. If your team uses a document assistant, Copilot, or ChatGPT, you already know enough.
The assessment is a scoping exercise, not a measurement of your systems. It indicates where your exposure is likely to concentrate and which obligations apply. It does not observe your pipelines. For an actual measurement of what your AI knowledge base returns and to whom, Hardshell publishes a free, open-source telemetry client that records exactly that.
Our AI data security guides cover the underlying failure modes in more depth, including how retrieval leaks data, data poisoning, and training data leakage.