Targeting
ICP & Account Playbooks
The accounts to call, the personas to ask for, the pains they carry, and the regulatory exposure that turns Shadow AI into a board-level conversation.
Best-fit accounts
Regulated industries, 250+ employees, an active Copilot / ChatGPT / Gemini rollout, and a named CISO, CCO, or CRO. Each card below maps the risk Shadow AI creates, the workflows where it shows up, the regulations that turn that risk into a finding, and the discovery questions to qualify the account in under 10 minutes.
Industry playbook
Wealth Management / Financial Advisors
Advisors paste client portfolios, KYC docs, and meeting notes into ChatGPT to draft client communications.
Books of business contain PII, account numbers, and material non-public information. Leakage triggers SEC Reg S-P and FINRA 4511 violations.
- •Drafting client emails
- •Summarizing review meetings
- •Generating retirement projections
- •Researching securities
Each of these expects a documented AI inventory, a DPIA / risk assessment, and evidence that sensitive data did not reach an unsanctioned model.
"Most RIAs we talk to discover within 30 days that 40%+ of their advisors are already pasting client data into ChatGPT. How are you seeing it at your firm?"
- 1.Has your CCO done an AI usage audit in the last 90 days?
- 2.What's your written policy on Copilot vs ChatGPT for client-facing work?
- 3.If a regulator asked for an AI inventory tomorrow, could you produce one?
- 4.How do you prove a client's PII didn't go into a public LLM?
Industry playbook
Banking
Branch and ops staff use ChatGPT to summarize loan files, customer complaints, and AML alerts.
OCC, FDIC, and CFPB have all issued AI risk guidance. Third-party LLM use without governance is a Matter Requiring Attention waiting to happen.
- •Loan file summarization
- •Complaint response drafting
- •AML narrative writing
- •Vendor due diligence
Each of these expects a documented AI inventory, a DPIA / risk assessment, and evidence that sensitive data did not reach an unsanctioned model.
"Your peers are getting MRAs over AI usage in middle office. Have your examiners started asking about AI inventories yet?"
- 1.How are you handling SR 11-7 model risk management for LLMs?
- 2.Do you have visibility into which AI tools your call center is using?
- 3.What's the plan for the OCC AI examination expected next cycle?
Industry playbook
Insurance
Underwriters and claims adjusters paste medical records, accident reports, and PHI into AI for faster decisions.
HIPAA, state DOI rules, and NAIC Model Bulletin 2023-1 all apply. Carriers face both regulatory and class-action exposure.
- •Claims triage
- •Underwriting summaries
- •Subrogation research
- •Policy language drafting
Each of these expects a documented AI inventory, a DPIA / risk assessment, and evidence that sensitive data did not reach an unsanctioned model.
"NAIC Model Bulletin requires you to govern AI used in underwriting decisions. How are you tracking what your underwriters actually use day to day?"
- 1.Are you tracking AI usage by line of business?
- 2.How do you prove non-discrimination in AI-assisted decisions?
- 3.Who owns AI governance - IT, compliance, or the CUO?
Industry playbook
Healthcare
Clinicians and billing staff paste PHI into ChatGPT to draft notes, appeal denials, and summarize charts.
Every paste is a potential HIPAA breach. OCR penalties can reach $1.9M per incident category.
- •Clinical note drafting
- •Prior auth appeals
- •Patient education
- •Coding assistance
Each of these expects a documented AI inventory, a DPIA / risk assessment, and evidence that sensitive data did not reach an unsanctioned model.
"Your privacy officer is probably losing sleep over ambient scribes and ChatGPT. Are you governing those separately?"
- 1.Do you have a BAA-covered AI option deployed?
- 2.How are you discovering shadow AI use across departments?
- 3.What happens when a clinician pastes a chart into ChatGPT today?
Industry playbook
Legal
Associates and paralegals use ChatGPT to summarize contracts, draft motions, and research cases - including privileged matters.
ABA Formal Opinion 512 requires competent AI use. Privilege waiver from public LLM use is now a malpractice risk.
- •Contract review
- •Discovery summarization
- •Legal research
- •Brief drafting
Each of these expects a documented AI inventory, a DPIA / risk assessment, and evidence that sensitive data did not reach an unsanctioned model.
"ABA 512 says you need a defensible AI competence program. Most firms we see have a policy on paper but zero visibility in practice - sound familiar?"
- 1.How are you preventing privilege waiver via public LLMs?
- 2.Which matters allow AI assistance and which don't?
- 3.Could you produce an AI usage log for a client audit?
Industry playbook
Pharma
R&D and medical affairs paste proprietary compound data, trial results, and patient narratives into AI tools.
FDA 21 CFR Part 11, GxP, and trade-secret exposure. A leaked compound structure is irreversible IP loss.
- •Literature review
- •Trial protocol drafting
- •Medical writing
- •Regulatory submissions
Each of these expects a documented AI inventory, a DPIA / risk assessment, and evidence that sensitive data did not reach an unsanctioned model.
"Pharma IP leakage to public LLMs is uninsurable. How is your CISO measuring it right now?"
- 1.Do you have a sanctioned LLM for R&D?
- 2.How are you handling AI in GxP-validated systems?
- 3.What's your stance on Copilot in regulated workflows?
Industry playbook
Government Contractors
Cleared and uncleared staff use ChatGPT on documents that may contain CUI or ITAR-controlled data.
CMMC 2.0, NIST 800-171, and OMB M-24-10 require AI inventory and risk management. A single CUI leak can suspend a contract.
- •Proposal writing
- •Technical documentation
- •Code generation
- •Briefing summaries
Each of these expects a documented AI inventory, a DPIA / risk assessment, and evidence that sensitive data did not reach an unsanctioned model.
"OMB M-24-10 mandates an AI use inventory. Are you ready for your next CMMC assessment to include AI controls?"
- 1.Have you scoped AI within your SSP?
- 2.Which AI tools are FedRAMP-authorized for your environment?
- 3.How are you preventing CUI from reaching public LLMs?
Industry playbook
MSP / MSSP Partners
Your clients are all asking about Shadow AI - and you don't have a productized answer yet.
Workforce AI Security is the next managed service. First-movers lock in 3-5 year MRR contracts.
- •AI risk assessments
- •Managed AI governance
- •AI policy as a service
- •Incident response for AI leaks
Each of these expects a documented AI inventory, a DPIA / risk assessment, and evidence that sensitive data did not reach an unsanctioned model.
"Every one of your regulated clients is going to ask you about AI governance in the next 6 months. Do you have a SKU for it yet?"
- 1.How many of your clients have asked about Copilot governance?
- 2.What's your current AI services revenue?
- 3.Do you want to white-label or co-sell?