Skip to main content
Inventory & Risk

AI Tool Inventory & Risk Mapper

Catalog every AI tool your organization uses. Score each one across four risk dimensions, then get a prioritized mitigation plan to close your biggest gaps first.

Quick Answer

An AI tool inventory is a catalog of every AI-powered application used across your organization, LLM APIs, coding assistants, AI SaaS products, custom models, and agent platforms. Each tool is scored on data sensitivity, integration depth, user scope, and vendor security posture to produce a weighted risk level. The output is a prioritized action plan that tells you which tools to secure first.

Your inventory is empty

Click "Add AI Tool" above to start cataloging. Add every AI tool your team uses, LLM APIs, coding assistants, SaaS apps with AI features, custom models, and agent platforms.

How Risk Is Calculated, The Four Dimensions

Data Sensitivity (×0.30)

What kind of data goes through this tool? Public docs score low. API keys, PHI, and trade secrets score high. Data sensitivity is the highest-weighted factor, a tool is only as safe as what you feed it.

Integration Depth (×0.25)

How deeply is the tool connected? A browser tab is low risk. An SDK reading your codebase and making commits is high risk. Deeper integration means more data surface area.

User Scope (×0.20)

How many people use it? Individual use limits blast radius. Enterprise-wide deployment means one person's prompt can expose company-wide data patterns.

Vendor Security (×0.25)

Does the vendor have SOC 2? A data processing agreement? Known data practices? An unvetted startup is riskier than an enterprise vendor with published compliance certifications.

How the Risk Mapper Works

AI Tool Risk Assessment PipelineCatalog ToolsName, Category,Vendor InfoScore Dimensions4 Risk Factors,Weighted ModelRisk ScoreCritical / High /Medium / LowMitigation PlanPrioritized by Risk Level → Action ItemsYOUR ORGANIZATION

Frequently Asked Questions

Most organizations have far more AI tools in use than leadership realizes. This is called shadow AI. Employees sign up for ChatGPT, use Copilot in their IDE, run Notion AI on internal docs, and experiment with Midjourney for presentations. Without an inventory, you can't assess risk, enforce data policies, or demonstrate compliance to auditors. AI governance frameworks like NIST AI RMF 1.0 start with the MAP function, and you can't map what you haven't cataloged.

Data sensitivity carries the highest weight (30%) because the type of data flowing through a tool is the primary determinant of real-world impact. A tool accessing restricted data, API keys, PHI, trade secrets, is inherently high risk regardless of vendor security posture or integration depth. A SOC 2 compliant vendor receiving your source code is still a risk if they train models on it.

The NIST AI RMF defines four core functions: Govern, Map, Measure, and Manage. This tool directly supports the Map function (cataloging AI systems and their context) and feeds into Measure (assessing risk levels). It's a practical implementation of the RMF's guidance, not a replacement for a full RMF program, but the first step every RMF implementation needs.

Quarterly at minimum for most organizations. AI tools proliferate rapidly, new capabilities, changed vendor data policies, and team adoption of new tools happen within weeks. For regulated industries (healthcare, financial services, defense), monthly reviews are recommended. Set a recurring calendar reminder and make the inventory part of your vendor risk management cadence.

Start with your Critical and High-risk tools. For each one, determine whether you need to: (1) deploy a security control like local redaction (Shield), (2) renegotiate vendor terms or data processing agreements, (3) restrict usage to less sensitive data, or (4) replace the tool with a more secure alternative. Document decisions in your risk register and track remediation through to closure.

The tool generates a structured inventory you can screenshot or copy. For a formal audit trail, export the tool list as a CSV or JSON from your browser's developer console, or use this assessment to seed your formal GRC platform. The risk scores, dimensions, and mitigation suggestions provide documentation that auditors recognize as systematic risk assessment.

Related Artifacts

AI Security Maturity Model
Assess your org's security posture
Vendor Security Questionnaire
Evaluate any AI vendor
Shadow AI Risk Estimator
Estimate hidden AI exposure

Ready to secure every AI tool in your stack?

Shield is a local gateway that stops passwords, customer data, and company secrets from ever leaving your computer, before they reach ChatGPT, Claude, Copilot, or any AI model.

How Shield Works Talk to Our Team

Last updated: July 20, 2026