The Ofreygo Audit
A flat-fee engagement to map, assess, and plan remediation for your company’s Shadow AI. 48-hour discovery window. 5-day analysis. One executive readout. Zero scope creep.
Discover. Consolidate. Govern.
Discover
We scan your SSO logs, expense reports, Slack, GitHub, and Drive to find every AI tool, agent, API key, and workflow in use. 48 hours.
Consolidate
We map what we found, who owns it, what it costs, and what’s at risk. You get a landscape report, risk register, and 30/60/90 roadmap.
Govern
We deliver the roadmap or help you execute it. Either way, you walk out with a plan your CISO, CTO, and CEO all understand.
Six deliverables. One flat scope.
Every engagement ships the same six artifacts, rendered as production documents and presented in one executive readout. Preview the format below — figures shown are illustrative.
AI Landscape Map
Every tool, agent, key, workflow, and owner — on one page.
Risk Register
Ranked security, compliance, and continuity risks with owners.
Spend Analysis
On-ledger vs off-ledger AI spend and consolidation savings.
30 / 60 / 90 Roadmap
Prioritized remediation, sequenced for a 90-day execution window.
Executive Readout
A 60-minute leadership presentation deck your CISO, CTO, and CEO will all accept.
Governance Starter
One-page policy scaffold, pre-mapped to SOC 2, ISO 27001, and NIST AI RMF controls.
Three engagement tiers. One flat scope.
Every Ofreygo engagement is scoped, priced, and delivered on a fixed fee. No hourly billing. No scope creep. Engagement fees are quoted on a brief qualification call; the structure is the same regardless of tier.
Ofreygo Audit
The standard engagement for AI-native companies.
- All six deliverables
- 48-hour discovery window
- 60-minute executive readout
- Mutual NDA + DPA included
Ofreygo Audit Extended
Multi-team discovery with a drafted governance policy.
- Everything in Audit
- Custom governance policy drafted for your org
- Additional stakeholder interviews across functions
- Multi-team discovery scope
- Named senior delivery lead
Ofreygo Audit Enterprise
Scoped to the complexity of a multi-business-unit discovery.
- Custom scope across business units
- Integration with existing security + compliance programs
- Senior advisor engaged per-scope under NDA
- Board-ready executive package
- Optional quarterly refresh engagement
The questions everyone asks
How is this different from a SaaS management tool like Zylo or Torii?
SaaS management tools find the apps on your bill. They can’t see custom GPTs in personal ChatGPT accounts, n8n workflows on someone’s VPS, API keys expensed to personal cards, or MCP servers on internal GitHub. Ofreygo finds all of it.
Why not assign this to an engineer for two weeks?
The job isn’t any single scan — it’s running 10+ discovery sources in parallel and synthesizing them into a deliverable a CISO, CTO, and CEO will all accept. An internal engineer gets ~30% of the way through, then gets pulled back onto product work. Ofreygo ships a dated, defensible snapshot in 7–10 days, on a flat fee, against a methodology mapped to SOC 2, ISO 27001, and NIST AI RMF controls.
Do I need to give you admin access to our systems?
No. Audits use per-engagement, read-only scoped tokens that your team provisions and can revoke at any time — SSO log exports, expense CSVs, scoped Slack/GitHub tokens. We don’t hold persistent admin. We do not modify or delete anything.
What happens to our data after the audit?
All discovery data is deleted from Ofreygo systems 90 days post-delivery. The final deliverables (landscape report, risk register, roadmap) are yours to keep and remain confidential.
Can you sign our MNDA and DPA?
Yes. Standard practice. Ofreygo signs a mutual NDA before any discovery work begins, and a DPA covering any personal data touched during the engagement.
What if you don’t find anything?
Then you have a dated snapshot proving clean governance — useful for board reporting, SOC 2 evidence, and insurance. Still worth the fee.
How fast can we start?
Most audits kick off within 7–10 days of signed SOW. The 48-hour discovery window runs once access is scoped. Full delivery (including analysis and executive readout) runs 5–7 days after that.
What industries do you work with?
The Ofreygo Audit is designed for AI-native and AI-adjacent software companies in the 100–500 employee range. For regulated industries (healthcare, financial services, defense), custom scoping applies — contact us.
Ready to see your AI landscape?
Book a 20-minute call. We’ll walk through your current setup and decide together whether an Ofreygo Audit is a fit.
Where Mission Meets Compliance