Your team is building with AI.
Is any of it safe?
Every department has someone who has "built something with ChatGPT" or "made an app with Cursor". They mean well. But without a security review, every one of those tools is a potential data breach, compliance violation, or attack surface waiting to happen.
The problem nobody is talking about
AI coding tools are brilliant. They are also dangerous in unsupervised hands.
Hardcoded Secrets
API keys, database passwords, and tokens pasted directly into code that AI wrote. Pushed to GitHub. Indexed by bots within minutes.
Data Leakage
Customer data, financial records, and PII being processed through unvetted APIs. No encryption. No DPA. No audit trail.
Zero Input Validation
AI-generated forms and APIs that accept any input. SQL injection, XSS, and path traversal vulnerabilities that a junior developer would catch.
This is already happening in your business
A recent survey found that 78% of employees are using AI tools at work without IT department approval. They are building spreadsheet automations, customer-facing chatbots, internal dashboards, and workflow tools. Most of these have never been reviewed by anyone with security knowledge.
This is not a future problem. It is happening right now, in every department, at every company that has not explicitly addressed it.
What we review
We audit AI-generated code, tools, and automations across your entire organisation.
Security Review
- ✓ Authentication and authorisation flaws
- ✓ Hardcoded credentials and API keys
- ✓ SQL injection and XSS vulnerabilities
- ✓ Insecure API endpoints
- ✓ Missing input validation and sanitisation
- ✓ Unencrypted data at rest and in transit
Compliance Audit
- ✓ GDPR and UK Data Protection Act compliance
- ✓ Data Processing Agreement verification
- ✓ Third-party API data sovereignty checks
- ✓ Shadow IT inventory and risk register
- ✓ ISO 27001 alignment assessment
- ✓ Acceptable use policy mapping
Code Quality
- ✓ Error handling and edge cases
- ✓ Performance and scalability assessment
- ✓ Dependency vulnerability scanning
- ✓ Code maintainability and documentation
- ✓ Testing coverage analysis
- ✓ Architecture and design review
Infrastructure
- ✓ Hosting and deployment security
- ✓ Environment variable management
- ✓ Network exposure assessment
- ✓ Backup and disaster recovery
- ✓ Monitoring and logging gaps
- ✓ Access control and permissions
Real scenarios we have seen
These are the kinds of things we find when we audit AI-generated tools in businesses.
Finance team's "quick" reporting tool
An accounts manager built a tool with AI to pull data from Xero and generate weekly reports. The OpenAI API key was hardcoded in client-side JavaScript. The Xero OAuth token was stored in localStorage. The tool was accessible on a public URL with no authentication.
HR chatbot processing employee data
HR built a chatbot to answer employee questions about policies. It was trained on the staff handbook. But it was also sending every question to the OpenAI API, including questions about grievances, medical conditions, and salary disputes. No DPA existed with OpenAI. No data was encrypted.
Sales dashboard with SQL injection
A sales manager used Cursor to build an internal CRM dashboard. The search function concatenated user input directly into SQL queries. A single malicious input could have exported the entire customer database. The app was running on the company network with no WAF.
How it works
A straightforward process that gives you clarity within days, not months.
Discovery
We identify every AI-built tool, automation, and script across your organisation
Audit
Every tool gets a security review, compliance check, and code quality assessment
Report
You get a clear risk register, prioritised remediation plan, and executive summary
Remediate
We fix the critical issues, harden the good tools, and retire the dangerous ones
Pricing
Fixed-price engagements. No surprises.
Starter
Single application review
- ✓ Security vulnerability scan
- ✓ Dependency audit
- ✓ Written report with findings
- ✓ Remediation guidance
Business
Full shadow IT audit
- ✓ Organisation-wide discovery
- ✓ Up to 10 application reviews
- ✓ Compliance gap analysis
- ✓ Executive risk summary
- ✓ Remediation plan
Enterprise
Ongoing governance
- ✓ Everything in Business
- ✓ Continuous monitoring
- ✓ AI governance policy creation
- ✓ Staff training programme
- ✓ Quarterly re-assessment
Find out what your team has built
Book a free 30-minute discovery call. We will help you understand the scale of AI-generated code in your organisation and the risks it carries.