AI tool inventory
Find sanctioned tools, personal login shadow tools, browser extensions, meeting bots and AI features embedded in existing SaaS.
AI DLP & governance
AI data loss prevention for Australian teams
AI data loss prevention (AI DLP) is the work of stopping client records, source code and financial data from entering the wrong AI tool. VibeZero delivers it as a fixed scope engagement for Australian small businesses. The work combines an inventory, usable rules, staff guidance and technical controls suited to the systems in scope.
Describe the problem in a sentence or two. Please do not send credentials or sensitive records.
Want to gauge your exposure first? Take the free self check for an indicative risk score.
- Best fit
- Teams using Copilot and public AI with sensitive information
- Main deliverable
- Tool inventory, data rules and a prioritised control plan
- Client access
- A sponsor, a sample of staff and the relevant Microsoft administrator
- Commercial model
- Fixed scope assessment, project delivery or managed review
Delivery ownership
- Scope
- Review
- Findings
- Walkthrough
The accountable team stays involved from scoping through the final walkthrough. Specialist capability is added where the evidence needs it, with responsibilities agreed before work starts.
The leak surface
AI use creates a data path most businesses cannot see
A bookkeeper pastes a client's profit and loss statement into ChatGPT to summarise it. A salesperson asks Claude to redline a contract. A developer shares source code with a coding assistant. None is malicious; each person is trying to work faster.
Cyberhaven's 2026 AI Adoption and Risk Report says 39.7% of the AI interactions it analysed involved sensitive data. That is vendor research, not a measure of your environment. No control removes every path.
Across a team, that adds up to exposure that is hard to see until something goes wrong. AI DLP brings approved tools and the personal accounts, meeting bots, browser assistants and embedded SaaS features found during the agreed review under one set of usable rules.
Scope
What an AI DLP engagement covers
Data classification
Define plain English categories for client records, source code, financial data, health information, contracts and other sensitive material.
Microsoft 365 controls
Reduce oversharing and inappropriate access with agreed sensitivity labels, Purview rules and conditional access settings.
Public AI tool policy
Write usable rules for ChatGPT, Claude, Gemini and other public tools, with safer alternatives where the use case is justified.
Meeting bot and SaaS AI
Review which assistants are processing company data, disable unjustified features and document approved ones.
Incident response
Create a step by step playbook for assessment, documentation, vendor contact and possible Notifiable Data Breach obligations.
Client perspective
A client view of our security review work
Stacey Blackwell describes how VibeZero scopes, reports and hands over technical work. The feedback covers delivery practice rather than this service.
Every issue came with a practical fix, sequenced so we could ship safely, and they handed over their testing tools so the value outlasted the engagement.
Engagement status
Assessment, implementation or managed review
Pricing is on application, with scope and the figure agreed in writing before commencement. See the Pricing page for how projects and retainers are handled. The assessment can also reference our Privacy Act 2026 checklist, but it is not legal advice or compliance certification.
Assessment | one off
Assessment
A fixed scope written assessment, usually the starting point for a small business and estimated at two to three weeks.
- AI tool inventory
- Data classification
- Privacy control gap review
- Prioritised remediation list
Implementation | project
Implementation
We deliver the agreed remediation in an estimated four to eight weeks.
- Everything in Assessment
- Microsoft 365 controls configured
- Policy and cheat sheet written
- Staff training delivered
Managed | retainer
Managed
Ongoing monitoring and quarterly review on a rolling monthly retainer.
- Everything in Implementation
- Quarterly control review
- New tool risk reviews
- Incident guidance within agreed support hours
Pricing is on application. The engagement type, scope and fee are agreed in writing before commencement.
Method
How the engagement runs
We work primarily with Australian small businesses of five to fifty staff, with the assessment as the usual starting point.
Scope
30 min scoping call
We confirm the tier, contact, boundaries and what is in or out of scope.Inventory
Map the AI tool surface
We review sanctioned tools, reported personal use, meeting bots, browser plugins and embedded SaaS AI within the agreed scope.Classify
Map the data risk
We identify the data categories that should never reach a public AI tool.Remediate
Reduce the leak surface
We configure the agreed controls, the client signs off the public tool policy and we deliver staff guidance.Maintain
Keep it current
The Managed tier reviews controls quarterly as tools and vendor terms change.
Choose the right starting point
Readiness, usage, DLP or privacy advisory
Whole organisation
AI Readiness Audit
Use this when leadership needs to understand opportunities, operating gaps and the order of work.
Read about AI Readiness AuditStaff behaviour
AI Usage Review
Use this when you need a reported snapshot of tools, practices and data handling before writing policy.
Read about AI Usage ReviewControlsCurrent service
AI Data Loss Prevention
Use this when the priority is policy, staff guidance and technical controls around AI data movement.
One platform
Data and Privacy Advisory
Use this when a nominated CRM or platform needs an independent review of hosting, access, retention and response.
Read about Data and Privacy AdvisoryBoundaries
What this engagement is not
Not in scope
Network or device DLP
Endpoint and network DLP remains the MSP's territory; this engagement focuses on the AI tool surface above it.
Not the objective
A blanket AI ban
The objective is productive sanctioned use with risky paths made difficult, not a prohibition staff work around.
No reseller interest
A Microsoft licence sale
VibeZero does not resell Microsoft 365 SKUs or earn margin on Copilot licences.
Advisory boundary
Legal advice
We work alongside privacy counsel and do not replace legal opinions or final compliance sign off.
Separate service
A penetration test
AI DLP addresses authorised user data leakage; penetration testing addresses unauthorised access.
Triggers
When this engagement makes sense
Copilot rollout
Microsoft 365 Copilot is live or imminent
Sensitivity labels and Purview rules need review before staff use Copilot with sensitive information.
Cyber insurance
Renewal form has AI questions
An insurer or procurement form asks for evidence of AI policy, data handling and incident response.
Near miss
Something nearly went wrong
A staff member shared information with a public tool and the business wants a repeat prevented.
Regulator pressure
Sector regulator asking about AI
A regulator wants to know how client or patient information is governed when AI is used.
Tender
Procurement questionnaire
A larger client or government tender requires credible answers on AI governance.
Shadow AI
Staff using personal AI logins
The business suspects company data is moving through personal ChatGPT, Claude or Gemini accounts.
Practical details
Questions about AI Data Loss Prevention
What is assessed, what you receive and where advisory responsibility stops.
AI data loss prevention is the work of reducing the chance that confidential data leaves the business through AI tools. It can cover Microsoft 365 permissions, staff pasting information into public AI tools, meeting bots, browser assistants and AI features inside existing software. The engagement combines proportionate technical controls, a written usage policy, staff guidance and an incident response playbook.
Start here
Map and reduce the AI data leak surface
Pricing is on application. The engagement type, scope and fee are agreed before commencement.Enquiries get a reply within one business day.