For MSPs

Shadow AI assessments as a billable deliverable

You already manage the client's DNS filter and firewall. That access, plus twenty minutes, produces a client-labeled audit report you can price as a service. No new stack, no reselling agreement, no certification course.

Run a free audit See the deliverable
10 / monthfull audits on the MSP plan
White-labelyour logo and brand on the PDF
~20 minexport to finished PDF per client
$60per report on the 5-pack
shadow-ai-audit.pdf Cover of the sample Shadow AI audit report prepared for an example company, with its headline findings. Sample report View all 11 pages Opens in your browser · PDF
The opportunity

Why shadow AI became an MSP service line

Your clients are asking someone about AI exposure. The MSP that answers with evidence keeps the account.

The question is already coming

Client boards and insurers now ask what AI tools staff use. Your clients cannot answer, and they will pay whoever can. The one who runs their network is the natural whoever.

You hold the access

The audit needs one log export from a console you already administer. What costs a consultant a week of onboarding costs you a coffee break. The margin lives in that gap.

It bills like a project

Consulting-led shadow AI assessments are quoted in the thousands and take weeks. Your delivery cost is a plan allowance and twenty minutes, which leaves the margin with you.

The deliverable

What you hand the client

A three-part evidence pack with the client's own name on it, generated from their own logs.

shadow audit · MSP client run

Shadow AI Audit  |  Meridian Legal LLP

Scope: Meridian Legal LLP. AI tools observed in the supplied network export, matched against 11,841 classified AI tool domains.

23
AI tools found
3
high-risk
21
unsanctioned

Client label as entered at run time. Sample data.

The PDF evidence pack

Summary tiles, the full tool table with dated training verdicts, the per-user breakdown and a control evidence statement written for auditors. It reads as the client's document, not a vendor brochure.

The CSV

The complete tool table in machine-readable form. Drop it into the client's risk register or your own PSA notes without retyping anything.

Your recommendation layer

The report sorts tools into block, control and allow under a policy profile. Your value-add is turning those verdicts into configuration work, which is billable too.

Client exports are read once and discarded after the run. Reports stay in your account for 90 days and can be deleted earlier, which is worth stating in your engagement letter.

Catalog fit

Four places it slots into your service catalog

Teams rarely invent a new SKU for this. They attach it to motions that already exist.

Onboarding assessment

Every new client gets an audit in week one. It surfaces risk you would otherwise inherit blind, and it anchors the security conversation with evidence from day one.

The QBR artifact

Quarterly reviews need something new to say. A trend line of AI tool counts, quarter over quarter, is the slide clients photograph. Same export window every quarter makes it honest.

Incident triage

When a client suspects data went into a chatbot, the audit scopes it in an afternoon: which tools, which users, how much volume. Evidence before panic, facts before meetings.

Compliance add-on

Clients facing ISO 27001, GDPR or insurance questionnaires need a dated AI inventory. Sell the audit as the evidence step, then bill the remediation as usual.

The motion

A four-step engagement cadence that works

From cold mention to recurring line item, using documents that already exist.

1

Mention it with the sample

Attach the sample report to the next QBR agenda. One line: "we can produce this for you". The document does the explaining.

2

Free preview, live

In the meeting, run the free preview on a week of their DNS logs. Totals plus masked rows turn "interesting" into "what would the full one cost".

3

Deliver the full audit

Use a plan allowance or a pack credit, enter the client's name, deliver the PDF and CSV with your recommendations attached.

4

Make it quarterly

Book the same export window every quarter. The delta between reports becomes your standing QBR content and the client's compliance trail.

Unit economics

What it costs you, what it earns you

Your price to the client is your call. These are the delivery-cost facts to price against.

PathYour cost per full auditFits when
MSP Multi-Tenant plan25 audits/mo with client reports ($398/mo)You will run audits for several clients monthly. Reports are white-labeled with your brand, credits roll over, and at full usage it is $24.90 per audit.
5-pack$60 each ($299 / 5)You want inventory without a subscription, for a defined engagement season.
3-pack$66 each ($199 / 3)A pilot across three clients to test the motion before committing.
Single report$99One-off incident work or a single client proof of concept.

Reference point: standalone consulting assessments of the same question are quoted in the thousands. Even a conservatively priced assessment line leaves most of that as your margin. Full plan detail on pricing.

White-label

Send it as your own report

On the MSP plan the PDF is fully white-labeled: your logo, brand colour, company name, contact line and website on the cover, headers and footers, your own report title, and your own Introduction and Recommendations sections. No shadowaitools.com name and no links to our pricing anywhere in the PDF.

Cover and second page of a white-label Shadow AI Assessment PDF for a placeholder brand Open the 5-page white-label sample PDF

Set it once

Upload your logo and fill in your details on the Report branding page. It applies to every full report in your account, including ones you ran earlier.

Client upload links

Create a private link per client (expires after 7, 14 or 30 days, 1 to 3 uploads). The client sees only your logo, colour and name, uploads their DNS, proxy or firewall export, and the report lands in your account under their name. The client never sees the results; you present them.

How white-label works Sample PDF

Free previews and one-off reports keep our branding.

Multi-tenant mechanics

Running many clients without mixing them

The workflow is built around one export per client, one report per client, one label per report.

One export per client

Never merge client logs into one file. Separate runs keep evidence clean, retention independent and deletion per client possible.

The client label field

Set at run time, printed on every page of the PDF. It is what makes the deliverable read as theirs when it lands in their board pack.

Same window, every client

Standardize on 30 days. Comparable windows let you benchmark across your client base, which becomes its own advisory product.

MSP-managed DNS works

If you run client DNS through a shared filter, export per tenant or per site. The DNSFilter guide walks the multi-tenant export shape.

Identity columns vary

Some clients log users, some only device IPs. The per-user table appears when the column exists; the inventory works either way, just with different attribution depth.

Deletion on request

Reports can be deleted before the 90-day expiry, which answers the data-handling clause in most MSA reviews and gives clients per-engagement control.

Client objections

The three pushbacks, and the answers that land

Every MSP hears the same three. All three have evidence-shaped answers you can deliver on the spot.

"We barely use AI here."

Do not argue, run the free preview in the meeting. The average first run surprises the client, and the masked rows make the gap between belief and logs visible. If the preview really is clean, you have billed nothing and gained trust.

"Our people would tell us."

Staff underreport tools they suspect are unsanctioned, especially embedded AI inside approved SaaS. Logs do not have that incentive problem. The per-user table also shows it is usually many people, not one rogue user.

"Is our log data safe?"

The export is read once, in memory, and discarded. No agent, no persistent collector, and reports are deletable early. Put those three sentences in the engagement letter and the objection closes itself.

The QBR slide

What the quarterly slide actually shows

One slide, four numbers, and a sentence of interpretation. Build it from the report tiles in two minutes.

Tools found

This quarter vs last. Up means adoption is outrunning policy; flat means your controls are holding.

High-risk count

The number the client remembers. Getting it from 5 to 1 across two quarters is a story you sold and delivered.

Unsanctioned share

Sanctioned versus total, as a percentage. It measures whether the approved-tool list is real or decorative.

New since last run

Tools appearing for the first time. Each gets a one-line verdict in your recommendations: sanction, control or block.

Say the interpretation out loud in the meeting, then leave the slide in the deck. Clients re-read decks; they do not re-read PDFs, which is why the slide and the filed report both exist.

The awkward question

"Could the client just run this themselves?"

Yes, and some will. Here is why the assessment still belongs in your catalog.

They do not own the export habit

The audit is easy; remembering to run it quarterly, with a constant window and a clean export, is operations. Operations is literally what they pay you for.

They cannot act on the output alone

The report ends where configuration begins. Sanctioning, filter changes and enterprise-tier migrations are your tickets either way.

They want an accountable party

When the board asks who verified the AI inventory, "our MSP, quarterly, here is the trail" is the answer they want to give. Accountability is the service.

90-day plan

From zero to a running service line in one quarter

A concrete rollout used by small MSPs: no new hires, no new tooling beyond the plan.

W1

Prove it internally

Run the free preview on your own office network first. Your own surprises make the pitch authentic and give you a demo to show clients.

W2-4

Three pilot clients

Pick three friendly accounts, run previews in their review meetings, deliver one paid full audit from a 3-pack.

W5-8

Package and price

Write the one-page service description, set the price against the consulting anchor, move to the MSP plan when monthly volume justifies it.

W9+

Roll into QBRs

Every client review from now on opens with the AI slide. Renewals and upsells attach themselves to it naturally.

Independent consultants run a similar play with different economics, covered on the consultants page.

Worked scenario

Turning one audit into a recurring engagement

A 15-seat MSP runs its first client shadow AI audit at a QBR. Here is the chain of events that turns twenty minutes into a standing line item.

The setup

The MSP exports seven days of DNS logs from the client's Umbrella console, a task they already do monthly for their own security review. They upload the export and run the free preview during the meeting. The preview shows 19 AI tools, 14 unsanctioned, with 3 masked high-risk rows.

The client reaction

The client did not expect 19 tools. The masked rows create an immediate desire to see the full picture. The MSP offers to unlock the full report at their standard assessment rate, which is priced against the consulting-firm anchor of several thousand dollars.

The full report delivery

The MSP uses a pack credit to unlock the full report, enters the client's company name, and delivers the white-labeled PDF and the CSV, with three recommended actions in the MSP's own Recommendations section: block two high-risk tools, sanction three already-approved ones, and schedule a follow-up for the remaining fourteen.

The recurring engagement

The client asks for the same report next quarter. The MSP books a 30-day export window, sets a calendar reminder, and now has standing QBR content, a dated compliance trail and a new line item that costs twenty minutes and a plan allowance to deliver.

Detection coverage

What the audit matches against

The detection database behind every audit run. Updated daily, covering the long tail of tools that no manual list catches.

11,841+ AI tool domains

Every hostname checked against a daily-refreshed register of classified AI tools, from major platforms to single-developer tools registered last week.

18 categories, 168 subcategories

General chat, code assistants, image generators, companion apps, meeting recorders, agent frameworks and twelve more categories, each with subcategory granularity.

13 risk columns per tool

Trains on data, data sovereignty, abusive purpose, opt-out available, enterprise tier, API tier, retention, human review and more. Each flag is a policy decision your client can act on.

Open the sample report before your next QBR

It is the exact document your client would receive, on sample data, with the client's name on the cover and in every page header. Ten pages that sell the assessment for you.

Get the sample PDF
FAQ

MSP questions

The questions MSPs ask before adding the service line.

Can I white-label the report?

Yes, on the MSP plan. The PDF carries your logo, colour, company name and contact details, your own report title, Introduction and Recommendations, and no shadowaitools.com name or pricing links. See the white-label page and the sample PDF.

Do unused monthly audits roll over?

Yes. Unused MSP plan credits roll over to the next month. If you need more, extra credits are 1 for $99, 3 for $199 or 5 for $299.

What if a client's export is huge?

Full reports take 25 MB or 2,000,000 lines. Larger single exports are handled on request through contact.

Which log sources do client networks need?

Any DNS filter, proxy or firewall you already manage: Umbrella, Zscaler, Palo Alto, Fortinet, Cloudflare Gateway, DNSFilter, NextDNS, Pi-hole, SonicWall, Squid, or any CSV.

Can I run a free preview per client?

Free previews are capped per account at 1 a day and 3 a month, sized for demos. Sustained multi-client delivery is what the MSP plan allowance is for.

How do I price the assessment to clients?

Your call entirely. The useful anchors: consultants quote thousands for the same answer, and your delivery cost is a plan slot plus twenty minutes of your team's time.

Run the first client audit this week

Start with the free preview on one friendly client. The masked rows will write your pitch for the other nine.

Start with a free audit See pricing
Turn assessments into a monthly service Discover, report and document AI use for every client, with a monthly usage report and an AI compliance register.
The managed AI governance service →