You already manage the client's DNS filter and firewall. That access, plus twenty minutes, produces a client-labeled audit report you can price as a service. No new stack, no reselling agreement, no certification course.
Your clients are asking someone about AI exposure. The MSP that answers with evidence keeps the account.
Client boards and insurers now ask what AI tools staff use. Your clients cannot answer, and they will pay whoever can. The one who runs their network is the natural whoever.
The audit needs one log export from a console you already administer. What costs a consultant a week of onboarding costs you a coffee break.
Consulting-led shadow AI assessments are quoted in the thousands and take weeks. Your delivery cost is a plan allowance and twenty minutes, which leaves the margin with you.
A three-part evidence pack with the client's own name on it, generated from their own logs.
Shadow AI Audit | Meridian Legal LLP
Scope: Meridian Legal LLP. AI tools observed in the supplied network export, matched against our live register of 20,399 classified AI tool domains.
Client label as entered at run time. Sample data.
Summary tiles, the full tool table with dated training verdicts, the per-user breakdown and a control evidence statement written for auditors. It reads as the client's document, not a vendor brochure.
The complete tool table in machine-readable form. Drop it into the client's risk register, or your own PSA notes, without retyping anything.
The report sorts tools into block, control and allow under a policy profile. Your value-add is turning those verdicts into configuration work, which is billable too.
Client exports are read once and discarded after the run. Reports stay in your account for 90 days and can be deleted earlier, which is worth stating in your engagement letter.
Teams rarely invent a new SKU for this. They attach it to motions that already exist.
Every new client gets an audit in week one. It surfaces risk you would otherwise inherit blind, and it anchors the security conversation with evidence from day one.
Quarterly reviews need something new to say. A trend line of AI tool counts, quarter over quarter, is the slide clients photograph. Same export window every quarter makes it honest.
When a client suspects data went into a chatbot, the audit scopes it in an afternoon: which tools, which users, how much volume. Evidence before panic.
Clients facing ISO 27001, GDPR or insurance questionnaires need a dated AI inventory. Sell the audit as the evidence step, then bill the remediation as usual. See the ISO evidence page.
From cold mention to recurring line item, using documents that already exist.
Attach the sample report to the next QBR agenda. One line: "we can produce this for you". The document does the explaining.
In the meeting, run the free preview on a week of their DNS logs. Totals plus masked rows turn "interesting" into "what would the full one cost".
Use a plan allowance or a pack credit, enter the client's name, deliver the PDF and CSV with your recommendations attached.
Book the same export window every quarter. The delta between reports becomes your standing QBR content and the client's compliance trail.
Your price to the client is your call. These are the delivery-cost facts to price against.
| Path | Your cost per full audit | Fits when |
|---|---|---|
| MSP Multi-Tenant plan | 10 audits a month included | You will run audits for several clients monthly. Each report carries the client name you enter. |
| 5-pack | $60 each ($299 / 5) | You want inventory without a subscription, for a defined engagement season. |
| 3-pack | $66 each ($199 / 3) | A pilot across three clients to test the motion before committing. |
| Single report | $99 | One-off incident work or a single client proof. |
Reference point: standalone consulting assessments of the same question are quoted in the thousands. Even a conservatively priced assessment line leaves most of that as your margin. Full plan detail is on the pricing page.
The workflow is built around one export per client, one report per client, one label per report.
Never merge client logs into one file. Separate runs keep evidence clean, retention independent and deletion per client possible.
Set at run time, printed on every page of the PDF. It is what makes the deliverable read as theirs when it lands in their board pack.
Standardize on 30 days. Comparable windows let you benchmark across your client base, which becomes its own advisory product.
If you run client DNS through a shared filter, export per tenant or per site. The DNSFilter guide walks the multi-tenant export shape.
Some clients log users, some only device IPs. The per-user table appears when the column exists; the inventory works either way.
Reports can be deleted before the 90-day expiry, which answers the data-handling clause in most MSA reviews.
Every MSP hears the same three. All three have evidence-shaped answers.
Do not argue, run the free preview in the meeting. The average first run surprises the client, and the masked rows make the gap between belief and logs visible.
If the preview really is clean, you have billed nothing and gained trust.
Staff underreport tools they suspect are unsanctioned, especially embedded AI inside approved SaaS. Logs do not have that incentive problem.
The per-user table also shows it is usually many people, not one rogue user.
The export is read once, in memory, and discarded. No agent, no persistent collector, and reports are deletable early.
Put those three sentences in the engagement letter and the objection closes itself.
It is the exact document your client would receive, on sample data, with the client-label slot visible in the header. Three pages that sell the assessment for you.
One slide, four numbers, and a sentence of interpretation. Build it from the report tiles in two minutes.
This quarter vs last. Up means adoption is outrunning policy; flat means your controls are holding.
The number the client remembers. Getting it from 5 to 1 across two quarters is a story you sold and delivered.
Sanctioned versus total, as a percentage. It measures whether the approved-tool list is real or decorative.
Tools appearing for the first time. Each one gets a one-line verdict in your recommendations: sanction, control or block.
Say the interpretation out loud in the meeting, then leave the slide in the deck. Clients re-read decks; they do not re-read PDFs, which is why the slide and the filed report both exist.
Yes, and some will. Here is why the assessment still belongs in your catalog.
The audit is easy; remembering to run it quarterly, with a constant window and a clean export, is operations. Operations is literally what they pay you for.
The report ends where configuration begins. Sanctioning, filter changes and enterprise-tier migrations are your tickets either way.
When the board asks who verified the AI inventory, "our MSP, quarterly, here is the trail" is the answer they want to give.
"You could absolutely run this yourselves. What you are paying us for is that it happens every quarter, the findings turn into config changes, and there is a dated trail when anyone asks."
Transparency wins this conversation. The tool is cheap; the discipline is the service.
A concrete rollout used by small MSPs: no new hires, no new tooling beyond the plan.
Run the free preview on your own office network first. Your own surprises make the pitch authentic.
Pick three friendly accounts, run previews in their review meetings, deliver one paid full audit from a 3-pack.
Write the one-page service description, set the price against the consulting anchor, move to the MSP plan when monthly volume justifies it.
Every client review from now on opens with the AI slide. Renewals and upsells attach themselves to it.
Independent consultants run a similar play with different economics, covered on the consultants page.
The report carries your client's name as the subject and our engine as the producer. Most MSPs wrap it in their own cover letter with recommendations, which is where your brand belongs anyway.
Plan allowances are monthly. Purchased pack credits do not expire monthly, which is why some MSPs run a plan plus a pack buffer.
Full reports take 25 MB or 2,000,000 lines. Larger single exports are handled on request through contact.
Any DNS filter, proxy or firewall you already manage: Umbrella, Zscaler, Palo Alto, Fortinet, Cloudflare Gateway, DNSFilter, NextDNS, Pi-hole, SonicWall, Squid, or any CSV.
Free previews are capped per account at 1 a day and 3 a month, sized for demos. Sustained multi-client delivery is what the MSP plan allowance is for.
Your call entirely. The useful anchors: consultants quote thousands for the same answer, and your delivery cost is a plan slot plus twenty minutes.
Start with the free preview on one friendly client. The masked rows will write your pitch for the other nine.
Start with a free audit