About & Methodology
Why this exists
Most small businesses adopted AI tools organically — employees started using ChatGPT, Claude, Gemini, or similar tools because they're useful, not because the business rolled them out deliberately. That's normal, but it often leaves a gap between how AI is actually being used and what the business can see or control. Smarter AI Use exists to help close that gap with a quick, honest diagnostic and practical, free next steps — before pointing to any paid product.
How the Risk Check scoring works
The Shadow AI Risk Checker asks 12 questions across five categories: Sensitive Data & AI Usage (weighted up to 30 points), AI Tools & Connected Applications (up to 20), Identity & Access (up to 20), Policies & Employee Controls (up to 20), and Remote/Network Practices (up to 10). Each answer contributes exposure points based on how much uncertainty or risk it reflects — including "Unsure," which contributes points because not knowing is itself a gap in visibility. Points are summed to a 0–100 exposure score, grouped into four bands: Low (0–19), Moderate (20–39), Elevated (40–64), and High (65–100).
To identify your "biggest exposure areas," we don't simply rank categories by raw points — a 30-point category would always look worse than a 10-point category by raw score alone. Instead we calculate each category's exposure rate (points earned divided by that category's maximum), and rank by exposure rate first. This keeps the comparison fair across categories of different sizes.
What this tool can and can't tell you
This is a self-assessment based on your own answers, not an audit, penetration test, or compliance review. It's designed to give a small business a fast, honest starting point and a free, prioritized action plan — not a certification of security or compliance with any specific law or standard.
Our commitments
- No fabricated statistics, testimonials, case studies, or invented certifications.
- No claim that any product guarantees security, privacy, or compliance.
- Product recommendations are matched to your actual diagnosed exposure areas, not ranked by commission — see our Affiliate Disclosure.
- Your individual risk check answers are never sent to a server or to analytics — see our Privacy page.