The case studies below are composite scenarios drawn from real-world incidents and engagement patterns. Firm names, identifying details, and specific figures have been changed to protect confidentiality while preserving the educational value of each scenario.
A 28-attorney regional firm faced a fabricated-citation sanctions order after a junior associate's ChatGPT-drafted brief made it to filing. The Sprint that followed produced the verification protocol and supervision framework the firm should have had before the incident.
A 35-employee RIA managing $450M in assets decided to get AI governance in place before their next SEC examination. The Sprint discovered 14 tools in use across the firm — and produced the evidence package the SEC examiner specifically asked for nine months later.
A 65-person B2B SaaS company in SOC 2 Type II prep discovered the gap that would have failed the audit: their product's AI features and their team's internal AI tools were unmanaged under the same trust services criteria. The Sprint closed both gaps in time for the audit window.
A 120-employee defense subcontractor lost a $2.4M contract after a senior engineer uploaded ITAR-controlled specs to a consumer AI tool. The Sprint surfaced the full exposure; the Implementation got the firm to CMMC Level 2 in time to rebuild the customer relationship.
A 60-employee CPA firm caught a staff accountant uploading client tax packages to ChatGPT mid-season. The two-week Sprint that followed got them carrier-ready by December renewal.
Assess your shadow AI risk before it becomes an incident.