AI usage discovery
Teams adopt AI tools and integrations faster than anyone can track them. AI usage discovery finds the AI systems and integrations in use across your organisation, so they can be brought into Q9 Continuous testing scope.
01What it does
What it does
AI usage discovery identifies the AI tools, models and integrations in use across an organisation, and the data they handle.
The aim is visibility: what is being used, by whom and with what data, so the systems that matter can be brought into Q9 Continuous testing scope and you can decide what to approve, restrict or replace. Coverage is confirmed during scoping.
02Risk register
Risks we evaluate
What Q9 Continuous tests for within your agreed scope. Coverage is confirmed during scoping; not every item applies to every deployment.
- 06.01Unsanctioned AI toolsAI applications and browser extensions adopted without approval.
- 06.02Data leakage into AI servicesCompany or personal data moved into services outside your control and policies.
- 06.03Unmanaged models and integrationsModels or AI features connected to company systems without review.
- 06.04Policy gapsAreas where acceptable-use, data handling or procurement policies do not cover AI.
03Who needs it
Who needs it
- Enterprises with multiple teams adopting AI independently.
- Organisations preparing AI governance or acceptable-use policies.
- Security and compliance teams that need an inventory of AI in use.
04Approach
How Q9 Continuous tests it
Every test follows the same path, agreed in writing before any testing starts.
Discovery
We agree which teams, systems and data sources are in scope, based on your risk appetite and compliance obligations.
Agreed scope & written authorisation
The sources, access and timing are agreed in writing. Nothing is examined without written authorisation from the people responsible for it.
Discovery within scope
AI systems and integrations are identified using only the sources and access agreed in writing.
Human-reviewed findings
Every finding is reviewed by a person before it reaches you, with context and stated limitations.
Into testing scope
The AI systems that matter can be brought into Q9 Continuous testing, within a scope you authorise.
Testing runs on Q9 Continuous: fixes and significant changes can be re-tested within the authorised scope, and Q9 Driftmark (early access) can show when a checked system changes. Automated checks complement, and do not replace, independent penetration testing.
05Deliverables
What you receive
- An inventory of AI applications discovered in the agreed scope
- A risk score for each application, with the reasoning behind it
- Identified policy gaps and recommended next steps
Each test is a point-in-time check of an agreed scope. It is not a certification and does not guarantee that every risk has been found.
What We Test
Other things we test
- 01
Large language models
Prompt injection, jailbreaks, unsafe model behaviour and the data a model can reach.
- 02
Retrieval-augmented generation (RAG)
Retrieval pipelines, vector stores and knowledge-base isolation.
- 03
Agentic AI and tool execution
Autonomous agents, the tools they call and the permissions they hold.
- 04
APIs and application endpoints
The APIs and model endpoints that connect AI to your business.
- 05
AI application security controls
Model access, data flows, trust boundaries, secrets and monitoring.