Home · AI
AI Advisory and Enablement
AI arrived in most companies from the bottom up, one person at a time, with nobody deciding anything. What is anyone allowed to use, and how much can it see? We settle both before helping anyone go faster.
Shadow AI discovery
Copilot, ChatGPT and Claude
Policy and guardrails first
What went wrong for everybody else
602 breaches, and what was missing
IBM studied 602 organizations breached between March 2025 and February 2026. Which model a company picked barely moved the cost. The governance around it set the bill.
68%
were operating without a settled AI governance policy when they were breached. Thirty-five percent had put nothing on paper, and another thirty-three were still working on a draft.
43%
had a security incident involving shadow AI, meaning a tool an employee started using without asking. A year earlier that figure was twenty percent.
19%
reported any coordination between the people writing governance and the people running security. That gap is where most of the cost lives.
All three figures from IBM's 2026 Cost of a Data Breach Report, 602 organizations studied March 2025 to February 2026. Checked September 2026.
How the work runs
Discover, govern, secure, then enable, and the order is the point
Most firms start at the end, buy licenses, and find out afterward what the tool can see. Open any stage for what it involves.
Discover
Govern
Secure
Enable
Where to start
Two pages worth reading before you buy anything
Both are built around published figures and vendor documentation, and both name their sources so you can check them.
Microsoft 365 Copilot deployment
A pilot is how most firms find out how wide their permissions have grown, because the assistant answers from everything the asker can already reach. The page lists six tenant conditions to settle before the first license is assigned, and the four-step sequence that gets a firm there in three to six weeks. It also covers ChatGPT and Claude, and where each one earns its place.
AI acceptable use policy
The document runs to eight sections, and the page works through what each has to pin down before it is any use to somebody reading it at five in the evening. The page covers the California penalty that now reaches automated decisionmaking, the questions your insurer has started asking about AI, and a template you can put your own tool names into.
Not sure which one applies? The readiness assessment covers discovery and governance together, so you come out of it holding the inventory, the risk tiering and a draft policy.
Proof, not promises
130+ staff
Mal Warwick Donordigital: the permissions work came first, then Microsoft Copilot and AI document search went out across the whole firm.
2 to 6 weeks
From nothing written down to Copilot live across a firm. The policy and the deployment overlap, and what moves the range is how much oversharing turns up in the tenant.
Common questions
What people ask before they commit
Half our staff are on ChatGPT and nobody approved it. Do we shut that down first?
Can we skip the policy and go straight to Copilot?
How long does the whole thing take?
Do you push Microsoft because you are a Microsoft shop?
We are twelve people. Is this overkill for us?
How do we know any of this paid off?
Do you know which AI tools your team is using today?
Most firms find out during the discovery, and it is rarely the list they expected.