Shadow AI at the first gate
Hartwell Trust Bank checks an outside AI use case with fictional data.
Coming
See every demonstrationAI READINESS REMEDIATION
Defend the readiness score before you sign the license commitment.
Microsoft's free AI Readiness Assessment is a questionnaire; its score is what the respondents believe, and a large Copilot commitment is a poor thing to rest on belief. In fifteen days we re-score all seven pillars against tenant signals, report where measurement differs from self-report, cost the remediation into before, during and later, and write a buy, phase or defer recommendation per department.
01 Source02 Boundary03 Human decision04 Evidence
HOW IT WORKS
The control path in practice.
- Re-score all seven pillars with each answer backed by a tenant signal or marked unmeasurable.
- Write the variance report: where the measured posture differs from the self-reported score, with the evidence.
- Interview five to ten departments for use case fit and cost the remediation into fix before purchase, during rollout, or later.
- Deliver a written buy, phase or defer recommendation for each department, read-only throughout.
THE PROBLEM
What is wrong with the free readiness score?
Nothing, as a conversation starter. As the basis for a large license commitment it reflects what the people in the room believed on the day, and the pillars it scores (data foundations, governance and security, infrastructure) are the ones a tenant can actually measure.
Run Microsoft's free assessment first; this engagement adds measurement to it and is willing to say defer. Every pillar answer is backed by a tenant signal or marked unmeasurable, so the variance between belief and evidence is itself a deliverable.
THE MICROSOFT INSIGHT
What does the tenant measure that the questionnaire cannot?
The data foundation: Microsoft 365 Copilot returns only what each person can already open, so the oversharing the Purview posture assessment reports is a direct measure of the data pillar, and the identity and device posture in Entra and Intune measure the governance and infrastructure pillars.
Microsoft 365 Copilot returns only content the signed-in user already has at least view permission to see, so anything shared too widely is findable from day one. (Microsoft Learn, checked Oct 31, 2026)
Measure the pillars and the recommendation per department rests on evidence you can defend to a board. Score them by show of hands and the commitment rests on optimism.
THE METHOD
What happens in the fifteen days?
A measured re-score, a variance report, department interviews, a costed plan and a recommendation.
- Re-score the seven pillars (business strategy, AI governance and security, data foundations, AI strategy and experience, organization and culture, infrastructure, model management), each answer backed by a tenant signal or marked unmeasurable.
- Write the variance report with evidence where measured differs from self-reported.
- Interview five to ten department leads for use case fit.
- Cost the remediation into before purchase, during rollout, or later, with effort estimates.
- Write the buy, phase or defer recommendation per department.
THE EVIDENCE
Where does the evidence come from?
Read-only reads of Microsoft Graph, Entra ID for identity and device posture, Microsoft 365 configuration for licensing and adoption, SharePoint and Purview for data quality and oversharing, Secure Score and the Azure resource inventory; culture and use case fit come from structured interviews.
Microsoft Purview Data Security Posture Management for AI runs a weekly data risk assessment of the 100 most used SharePoint sites without activation and reports AI interactions that touch sensitive data. (Microsoft Learn, checked Oct 31, 2026)
Collect the signals and the variance report is a list of fixes with owners. Skip them and the only signal is the renewal invoice.
WHAT IT IS NOT
Does the engagement fix anything?
No. Evidence collection is read-only and nothing is changed. Remediation is costed here and delivered separately or under a sprint plan, use case fit covers only the interviewed departments, and custom AI systems on Azure are assessed separately.
Prerequisites are a completed Microsoft AI Readiness Assessment result and Microsoft 365 E3 or better. Access is Global Reader consent, five to ten department leads for 45-minute interviews and a named executive sponsor. The pillars are Microsoft's and follow its revisions.
AFTER TWO WEEKS
What will be working after two weeks?
- Every pillar score is backed by a tenant signal or marked unmeasurable.
- You hold the variance report: where the measured posture differs from the self-reported score, with evidence.
- You hold a costed remediation plan split into before purchase, during rollout and later.
- Each interviewed department has a written buy, phase or defer recommendation.
The work is delivered remotely inside your own Microsoft tenant, wherever your business is, and on site only when the work needs it.
HONEST ABOUT LIMITS
What this does not do yet
It does not score what the license includes until the license is named. Microsoft 365 E7, generally available since May 1, 2026, includes Microsoft 365 E5, Microsoft 365 Copilot, the Microsoft Entra Suite and Microsoft Agent 365 in one license. (Microsoft Learn, checked Oct 31, 2026) Microsoft 365 E7, generally available since May 1, 2026, bundles E5, Copilot, the Entra Suite and Agent 365, and the recommendation names which pillars that changes and which it does not, so the buy, phase or defer decision is per department and per license, not one line for the company.
It does not remediate anything; the evidence is read-only and the fixes are scoped separately.
It does not assess custom AI systems on Azure; that is the Foundry readiness assessment.
THE ONE THING TO REMEMBER
A readiness score you can measure is one you can defend.
Said another way: seven pillars, each with a signal or an honest unmeasurable.
Said a third way: the most valuable word in the recommendation is defer, when the evidence says so.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
Do we need the free Microsoft assessment first?
Yes. A completed Microsoft AI Readiness Assessment result is a prerequisite; the engagement re-scores it against the tenant rather than starting from a blank page.
What access do you need?
Global Reader consent, five to ten department leads for 45-minute interviews and a named executive sponsor. Nothing is changed in the tenant.
What do the fifteen days produce?
A measured re-score of the seven pillars, a variance report, a costed remediation plan in three buckets, and a buy, phase or defer recommendation per interviewed department.
Where is it sold?
On Azure Marketplace, bought through the Azure portal and billed on your existing Microsoft agreement; private offers on request. Plans and terms are on the listing. No price appears on this site.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.
Buy through Microsoft Marketplace Bought through the Azure portal and billed on your Microsoft agreement; plans and terms are on the listing.