How much does a shadow AI audit cost for consultants?

The 5-pack costs $299, which is $60 per full audit report. A single report is $99, and a 3-pack is $199 ($66 each). Credits do not expire, so you can allocate them across clients as engagements close.

Can consultants run shadow AI audits on behalf of clients?

Yes. The client provides a log export from their DNS filter, proxy or firewall, and you upload it from your own account. One account serves multiple client engagements, each using one report credit.

What do consultants deliver beyond the audit report?

Interpretation of findings, risk prioritization, sanctioned tool recommendations, acceptable-use policy drafts, blocking configuration guidance, and a quarterly monitoring cadence. The report is the evidence; the consultant adds the context and roadmap.

How long does a consultant shadow AI assessment take?

The audit itself runs in about 20 minutes. A full assessment engagement, including scoping, interpretation and presentation, typically takes 3 to 5 hours for a basic assessment or 8 to 12 hours with a remediation roadmap.

What follow-on work does a shadow AI assessment create?

Common follow-on engagements include AI acceptable-use policy drafting, sanctioned tool vendor reviews, blocking configuration, quarterly monitoring retainers, compliance documentation for frameworks like GDPR or ISO 27001, and employee training.

Can consultants white-label the shadow AI audit report?

Yes, on the MSP plan ($249/month), which removes the shadowaitools.com name and adds your logo, colour, contact details, report title, introduction and recommendations. One-off reports and packs keep shadowaitools.com branding.

Is client log data stored after the audit?

No. The uploaded log file is processed once and discarded immediately. It is never stored, shared or reused. Finished reports remain in the account for 90 days and can be deleted earlier by the account holder.

Shadow AI Audit for Consultants: Deliver Assessments

The consultant math

Why the 5-pack is your engagement engine

Shadow AI assessments delivered by consultancies typically run into the thousands and take weeks. Your version costs $60 in tooling, takes an afternoon, and produces the same dated evidence.

Your cost structure

5-pack purchase$299

Cost per report$60

Your time per engagement3 to 5 hours

Tooling cost as % of a $1,500 engagement4%

What you charge the client

Assessment with findings deck$1,000 to $2,500

Assessment + remediation roadmap$2,500 to $5,000

Quarterly cadence retainer$1,500 to $3,000/qtr

Your gross margin on a single assessment$940 to $2,440

The single-report option is $99 if you want to test one engagement before buying the pack. The 3-pack at $199 ($66 each) works if five is more than your pipeline needs this quarter.

The engagement shape

Six steps from intro call to signed retainer

This is the consulting workflow. Each step is yours to own; the audit handles the detection mechanics so you can focus on interpretation and advice.

1

Scope the log source and window

Ask the client which DNS filter, proxy or firewall they run. Agree on a 30-day export window. This is your intake call, and it doubles as qualification: if they have logs, you have an engagement.

Supported platforms: Cisco Umbrella, Zscaler, Palo Alto, Fortinet, Cloudflare Gateway, NextDNS, DNSFilter, Pi-hole, SonicWall, Squid
Also accepts any CSV with a header, key=value syslog or a plain hostname list
The platform guides carry the export steps per vendor

2

Run the free preview to qualify the opportunity

Upload the client's log export to the free audit. The preview shows totals by category, risk-flag counts, and up to 10 of the AI tools found by name. Every other tool appears as a withheld row.

Free preview limits: 5,000 lines, 2 MB, 1 per day, 3 per month
If the preview finds 15+ tools with withheld rows, the full report is an easy sell
Share the preview PDF with the client as the teaser

3

Quote the engagement and buy a report

Quote your assessment fee. Then use one credit from your 5-pack to run the full audit. The full report handles up to 25 MB or 2,000,000 lines per export.

Full report: every AI tool found, per-user or per-device breakdown, sanctioned vs. unsanctioned split, training verdicts, risk flags
Includes a downloadable CSV and a PDF evidence pack
Your $60 cost stays invisible to the client

4

Interpret and present findings

The report gives the data. You add the context the client cannot get from the tool alone: what to sanction, what to block, which teams need training, and where the compliance exposure sits.

Build a 10-slide deck: scope, method, top findings, risk summary, recommended actions
Walk the stakeholders through each section in person or on video
The how-it-works walkthrough maps each report section to what it answers

5

Deliver the remediation roadmap

Findings without a plan are a problem statement, not a deliverable. The roadmap is where your consulting value compounds: triage, sanctioning recommendations, policy drafts, vendor reviews.

Prioritize: abusive-purpose tools first, training-on-data risks second, unsanctioned general tools third
Draft the sanctioned tool list with request paths for new tools
Scope the blocking configuration if the client wants enforcement

6

Sell the quarterly cadence

One audit creates findings. Quarterly audits create a governance program. The retainer is the natural next step: each quarter, you re-run, measure the delta, and present the trend.

The 5-pack covers 5 quarters for a single client, or one quarter for 5 clients
Quarter-over-quarter deltas (new tools, blocked tools, sanctioned share) are the slide the board wants
Each re-run takes 20 minutes of your time and one report credit

What you deliver

Inside the audit report your client receives

The report is a technical evidence document. Your job is to translate it into business decisions. Here is what each section gives you to work with.

Audit Report: Example Industries (sample data) / 30-day DNS export

AI Tool	Category	Risk	Users	Training
ChatGPT	General Assistant	Medium	87	Opt-out available
Copilot	Code Generation	Medium	34	Enterprise tier: off
Grammarly	Writing	Low	61	Enterprise: no training
DeepSeek	General Assistant	High	12	Trains by default
Otter.ai	Meeting Transcription	High	9	Trains by default

The inventory table

Every AI tool found, its functional category, and the user or device count. This is the baseline you present as "what is happening today."

Risk and training flags

Each tool carries a risk level and a training-on-data verdict with the date the vendor's terms were last checked. High-risk and trains-by-default rows are your immediate action items.

Sanctioned vs. unsanctioned split

If the client has an approved-tool list, the report scores usage against it. The sanctioned share percentage is the governance metric that trends quarter over quarter.

Per-user breakdown

When the log source carries user or device identifiers, the report shows which teams drive which tools. You use this to target training and sanctioning conversations.

CSV export

The raw data for your own analysis. Filter, pivot, merge with the client's HR or asset data, and build the custom views your slide deck needs.

PDF evidence pack

Board-ready summary, full inventory, and compliance evidence in one dated document. Hand it to the client as the deliverable alongside your interpretation deck.

Positioning

What you are selling vs. what the tool does

The audit is the engine. Your value is the interpretation, the roadmap, and the ongoing governance. Keep the distinction clean in your proposals.

What the tool handles

Log parsing across 10 vendor formats
Hostname matching against 11,841+ AI tool domains
Risk classification and training-verdict lookup
Sanctioned vs. unsanctioned scoring
PDF and CSV generation
Dated, repeatable evidence trail

What you add

Scoping: which logs, which window, which stakeholders
Interpretation: what findings mean for this client's risk posture
Prioritization: which tools to sanction, which to block, in what order
Policy drafting: acceptable-use updates, request paths, exception handling
Stakeholder facilitation: presenting to the CISO, legal, department heads
Cadence design: the quarterly rhythm that turns a project into a program

Clients buy the assessment because they lack internal bandwidth, not because they lack the tool. Your proposal prices your time and judgment, not the report. The report is the evidence that makes your recommendations defensible.

Engagement models

Three ways to package the service

Match the engagement shape to the client's maturity and budget. Each model uses the same underlying report; the difference is how much of your time wraps around it.

Model	Scope	Your time	Typical fee	Reports used
Assessment only	Run the audit, present findings, hand over the PDF and CSV.	3 to 5 hours	$1,000 to $1,500	1
Assessment + roadmap	Findings presentation, remediation priorities, sanctioned-tool list draft, policy recommendations.	8 to 12 hours	$2,500 to $5,000	1
Quarterly retainer	Quarterly re-run, delta reporting, board slide, policy updates, ad hoc advisory.	4 to 6 hours/qtr	$1,500 to $3,000/qtr	1 per quarter

Start with the assessment-only model to land the client. The findings almost always surface enough risk to justify the roadmap upsell. The quarterly retainer follows naturally once the first quarter's delta proves the value of monitoring.

Your proposal

What goes into the assessment proposal

A clean one-page proposal wins more often than a lengthy SOW. Here is the skeleton.

Objective: identify all AI tools in active use across the client's network using existing log infrastructure, without deploying agents or modifying network configuration.
Method: analysis of DNS, proxy or firewall logs against a maintained database of 11,841+ AI tool domains, covering 18 functional categories.
Input required from client: a 30-day log export from the DNS filter, proxy or firewall they already operate. One file, standard export format.
Deliverables: full inventory of AI tools found, risk and training-exposure flags per tool, sanctioned vs. unsanctioned breakdown, per-user or per-device detail where available, PDF evidence pack, raw CSV.
Timeline: findings presentation within 5 business days of receiving the log export.
Data handling: the uploaded log is processed once and discarded. It is never stored, shared, or reused. Finished reports are available in the account for 90 days and can be deleted earlier.
Optional add-on: remediation roadmap with sanctioning recommendations, policy draft, and quarterly monitoring cadence proposal.

Data handling is usually the first question. The log is read once and deleted. No content inspection, no prompt capture, hostnames and identifiers only. Lead with this in every proposal.

Your brand on the report

Co-branded and white-label reports

If the report should look like your work product rather than ours, the subscription plans put your brand on the PDF.

MSP plan: white-label

$249/month plus the client reports add-on at $149/month: 25 full audits a month, unused credits roll over. Your logo, brand colour, company name, contact line and website on the cover, headers and footers; your own report title, Introduction and Recommendations; no shadowaitools.com name or pricing links in the PDF.

Packs and one-off reports

The single report and the 3- and 5-packs keep our branding, as do free previews. Fine when you present the report as independent evidence inside your own deck.

The MSP plan also gives you private client upload links: the client uploads their log export on a page with only your logo and name, and the report arrives in your account. Details, the plan comparison and a white-label sample PDF are on the white-label Shadow AI Assessment page.

Qualification

Which clients are the right fit

Not every prospect needs a shadow AI assessment. These signals tell you who does.

Strong signals

They run a DNS filter, proxy or firewall but have never audited AI tool usage
A compliance deadline is approaching (EU AI Act, GDPR audit, ISO 27001 surveillance)
The CISO or IT director mentions "shadow AI" or "unauthorized tools" as a concern
They have 50+ employees and no sanctioned AI tool list
A recent incident involved data shared with an AI tool

Weak signals

Fewer than 20 employees with minimal SaaS usage
Already running a CASB with full AI tool classification (offer the audit as a validation layer instead)
No DNS-level logging in place and no budget to start
Interest is theoretical with no budget authority in the room

The sweet spot: organizations with 50 to 5,000 seats, a DNS filter or proxy already deployed, and a compliance or board-level motivation to quantify AI exposure. The compliance officer page carries the evidence-chain argument for that buyer.

Follow-on revenue

What the assessment findings open

The shadow AI assessment is a door opener. Here is the follow-on work the findings typically create, ranked by how often clients buy it.

AI acceptable-use policy

Most clients have no written AI policy. The assessment findings give you the specifics to draft one that names real tools, not hypotheticals. Typical fee: $2,000 to $5,000 depending on organizational complexity.

Sanctioned tool evaluation

The top 5 to 10 tools by usage need a vendor review: training terms, data residency, enterprise tier features. You run those reviews and deliver a sanctioning recommendation per tool. Typical fee: $500 to $1,000 per tool.

Blocking and enforcement configuration

Once the sanctioned list exists, somebody has to configure the DNS filter or proxy rules. The platform guides on this site walk through each vendor's export; the blocking configuration is your billable work.

Quarterly monitoring retainer

Re-run the audit every quarter, report the deltas, update policies as the landscape shifts. This is recurring revenue: one report credit and 4 to 6 hours of your time per quarter, billed at $1,500 to $3,000.

Compliance documentation

The audit report feeds DPIAs, AI Act risk registers, ISO 27001 evidence binders, and HIPAA risk assessments. If the client is under any of these frameworks, the compliance deliverable is a natural add-on. See the EU AI Act and ISO 27001 pages for the angle.

Employee training

The assessment names the tools people actually use. Training built on real findings lands harder than generic AI awareness decks. One session per department, anchored in their own usage data.

Worked scenario

A 200-seat logistics company in 3 hours

This is what an actual engagement looks like, from the first call to the signed retainer. Names and specifics are fictional; the workflow is real.

Hour 1: Scope and run

The IT director exports 30 days of Umbrella DNS logs. You upload the file, run the free preview (finds 28 AI tools, 19 withheld), then burn one pack credit for the full report. 22 minutes elapsed.

Hour 2: Interpret

The full report shows 28 AI tools across 9 categories. 4 train on customer data by default. 2 are flagged abusive-purpose. Sanctioned share: 0%, because no sanctioned list exists. You build 10 slides.

Hour 3: Present and propose

Walk the CISO and IT director through findings. The two abusive tools get blocked by end of day. You propose a remediation roadmap (sanctioned list, policy, quarterly re-run) for the follow-on SOW.

The upsell

Roadmap engagement closes at $3,500. Quarterly retainer starts next quarter at $2,000/qtr. Your total year-one revenue from one $60 report: $11,500. Four remaining pack credits serve four more clients.

Pack management

How to allocate your five credits

Five credits, multiple strategies. Choose based on your pipeline shape.

5 clients, 1 report each

Maximum pipeline breadth
Each client gets one baseline assessment
Convert the strongest findings into roadmap engagements
Quarterly re-runs come from the next pack

2 clients, multi-quarter

Deeper relationship with fewer clients
Client A: baseline + Q2 re-run (2 credits)
Client B: baseline + Q2 + Q3 (3 credits)
Delta reporting sells the ongoing retainer

1 client, full year

Baseline + 4 quarterly re-runs = 5 credits
Full-year governance narrative in one pack
Year-end report shows the complete trend
Strongest retainer conversion path

Need more than five? Buy another pack. Larger networks or custom export handling is available through the custom plan page. Credits do not expire.

Objection handling

What prospects ask, and your answers

Six questions you will hear in the sales conversation, with the responses that move the deal forward.

"Can not we just do this ourselves?"

They can, for $99. What they cannot do is interpret the findings, prioritize actions, draft policies, and build the quarterly cadence. That is your value, and it is why you charge 10 to 25 times the report cost.

"How is this different from a CASB?"

A CASB governs sanctioned SaaS going forward. The audit looks backward into existing logs and sweeps the long tail the CASB has not classified. They compose; the audit is faster and cheaper to start. See the detection methods comparison.

"What if we do not find anything?"

You will. Organizations with 50+ employees consistently find 15 to 40 AI tools in a 30-day window. The question is never whether AI is in use; it is how much and which tools train on the data.

"Our logs contain sensitive data."

The uploaded file is processed once and discarded. It is never stored, shared, or reused. Reports stay in the account for 90 days and can be deleted earlier. Hostnames and identifiers only; no prompt content is captured.

FAQ

Consultant questions

Can I white-label the report?

Yes, on the MSP plan ($249/month): your logo, colour and contact details, your own title, Introduction and Recommendations, and no shadowaitools.com name in the PDF. Reports bought as one-off credits keep our branding. See how white-label works.

Do credits expire?

No. The 5-pack credits stay in your account until you use them. Buy a pack at the start of the quarter and allocate credits as engagements close.

Can I run the audit on behalf of a client?

Yes. You upload the log export from your own account. The client gives you the file; you run the report and deliver the findings. One account, multiple client engagements.

What if a client's logs are too large?

Full reports handle up to 25 MB or 2,000,000 lines. For larger environments, reach out through the custom plan page for volume handling.

Is there a partner or reseller program?

Not currently, and none is needed. Packs start at $60 per report; if you run assessments every month, the MSP plan works out at $24.90 per audit at full usage and adds white-label reports. No intermediary agreements either way.

How do I learn the platform guides?

Each of the 10 supported log sources has a dedicated guide on this site. Start with the vendor your first client uses: Umbrella, Zscaler, Palo Alto, or any of the others.

Deliver shadow AI assessments at $60 a report