Shadow AI & security team session

Before the session

Read Days 41, 44 and 48 (about five minutes each), or Module 5 on the cheat sheet.

The 30 minutes

1. 0–5 minOpen

   Quick round, no blame: which AI tool, extension or app have you used for work that nobody signed off?

2. 5–15 minDiscuss three days
   • Day 41: It's already inside.Where are we using AI that the business can't see, and why did we reach for it?
   • Day 44: Company accounts. MFA. Clean exits.Who owns our AI accounts, is MFA on, and what happens to them when someone leaves?
   • Day 48: Verify through a second channel.If an urgent, unusual request came in by voice or video, how would we check it was real?
3. 15–25 minExercise: Map the doors

   List every AI tool, extension, app and built-in AI feature the team uses. For each one, note whose account it is, whether MFA is on, and what it can see or connect to. Circle any with no owner or broad access.

4. 25–30 minAction for the week

   Each person fixes one gap on a tool they use, such as switching on MFA or removing access it doesn't need, and brings back what they changed.

   Agree the team rule: “Urgent plus unusual? Call back.”