advisory
AI Exposure Analysis
Understand — and get ahead of — the risk your AI adoption is quietly creating.
The problem
AI coding tools turned every employee into a developer. The repos, side projects, and leaked-but-live credentials they leave in personal accounts never show up in your identity provider — and that's exactly where attackers look.
The outcome
A documented, repeatable map of your external AI-created exposure — validated and confidence-graded, with the highest-impact findings chained to what they'd actually unlock, and a remediation plan sized to your risk.
What you get
- Outside-in discovery of unmanaged, AI-created exposure (personal repos, exposed services, live credentials)
- Confidence-graded findings with a documented coverage map
- Controls-gap analysis
- Attack chains linking exposure to real business impact (esp. alongside a pentest)
- Prioritized remediation roadmap
- Optional year-over-year delta tracking
AI coding tools turned every employee into a developer — including the ones who’ve never heard “hardcoded credential” or “public by default.” They spin up repos, deploy side projects, and leave secrets in personal GitHub, Vercel, and npm accounts your identity provider will never show you. That unmanaged, AI-accelerated attack surface is the part no one owns — and it’s where I look.
Outside-in: what an attacker sees
I assess this the way an adversary would — from the outside. Not an agent installed in your environment or a read on your SSO, but external reconnaissance of the infrastructure your people actually built and left running: personal-account repositories, exposed services, credentials that are still live. The exposure you’ve already inventoried is rarely the one that hurts you.
Past the engineering team
The highest-risk exposure often isn’t from engineering — it’s the assistant, the analyst, the salesperson now shipping automations through an AI tool with no security context. I look there, because attackers do.
Discovery, then evidence — confidence-graded
Broad discovery surfaces candidate exposure; investigation validates it down to confirmed findings, each graded by confidence rather than asserted. You get a documented, repeatable coverage map — what was searched, what was found, and how sure I am — not a black-box scan you have to take on faith.
Chained to real business impact
An exposed credential is a fact; what makes it matter is what it unlocks. Where this runs alongside a penetration test, I connect exposure findings into attack chains against your actual environment — turning “there’s a key in a personal repo” into “here’s the path from that key to your data.” Findings come ranked by business impact, with remediation you can execute.
A baseline you can move
Run it once and you have a baseline. Run it again and you can watch the exposure trend down as your process improves — which is the point: not a one-time snapshot, but getting in front of what you’ll be exposed to next.