Get Your AI
ToolApproved.
Most AI tools enter your company the same way — quietly, unapproved, in a browser tab. This workbook walks you through the seven steps that turn that shadow usage into a pilot your security team signs off on. In about five hours.
- SOC 2 Type II Yes
- Training opt-out Yes
- Retention policy Unclear
- Export & delete rights Yes
"We will not use your Inputs or Outputs to train our models."anthropic.com/legal/commercial-terms
Your team is already using AI. The browser tab is open right now. This workbook isn't another blocker — it's the path to bring that usage into the open, governed, and approved.
Seven steps.
Roughly five hours.
One approved sandbox.
Each step is gated. You don't evaluate a vendor before you've classified your data. You don't generate a proposal before a peer has pressure-tested it. The sequence is the method — it's how you end up with a document security reads instead of rejects.
Champion Diagnostic
Business Needs
Security Buddy
Intake Form
Data Classification
Vendor Evaluation
Proposal Generator
The Reddit Test
Security doesn't say no to tools.
They say no to vague.
Three answers about data, tool, and outcome shrink the surface area security has to object to.
Every vendor claim is backed by the actual quote from their own policy — with a link.
You find the ally inside the security team before you ever submit anything. That changes the meeting.
Security reads one-pagers. They don't read decks. The output matches the attention they'll give it.
Rob T. Lee
Rob has spent more than twenty-seven years inside cybersecurity — Air Force cyber operations, intelligence work with AFOSI, the CIA, and NSA, and the early foundations of the field now known as digital forensics and incident response. He coined the term DFIR, and later cyber threat intelligence (CTI), when the practices they described still needed naming.
Today, as Chief AI Officer and Chief of Research at SANS Institute, his work focuses on the practical security of how organizations actually use AI — not how policy documents say they should. That work includes the SANS Critical AI Security Guidelines, partnerships with OWASP, advisory roles with the Foreign Intelligence Surveillance Court and the CSIS Commission on U.S. Cyber Force Generation, and this workbook: the companion to his LinkedIn Learning course Get Your AI Tool Approved.
The course lays out the philosophy — moving from shadow AI to sunlight. This workbook is where you actually do the work.