AI Stack Audit: What You Are Running, What It Costs, What To Kill

Written Updated by
AI stack audit · everything you are running · two weeks

You are paying for AI in six places. Nobody can tell you which ones do anything.

Two weeks finding every AI tool, subscription, API key and script running in your company, what each one costs, who actually uses it, which ones overlap, and which ones are sending your data somewhere nobody approved. You get an inventory with a keep, kill or rebuild verdict on every line, and the cancellation list usually pays for the engagement several times over.

Fixed price once scoped, never hourly. Two weeks, whole company. Paid in three milestones, you release each one only when you approve it. No tool to buy at the end, and no replacement to sell you.

Engineering expensed Copilot seats. Marketing has a writing tool on somebody’s card. Support bought a vendor bot that answers four questions. A developer who left last year wired an API key into a reporting script that still runs every night. Two of those do the same job. One of them has been pasting customer records into a third party since March. The invoices land on three different cards under three different names, and the only honest answer to what are we spending on AI is a shrug.

How it works

Find all of it. Cost it. Say keep, kill or rebuild.

Two weeks, three milestones, across the whole company rather than one department, because the overlaps and the duplicate spend are the point and they hide between teams. What I need from you is the finance exports, read access to whatever identity and billing systems you have, and permission to ask people what they actually use.

01

I find everything, including the parts nobody mentions

Card statements and vendor invoices, SSO and identity logs, browser extensions, API keys in your repositories and secret stores, scheduled jobs that call a model, and the short conversation with each team about what they actually open every day. Shadow spend turns up here, and it usually turns up on a personal card.

02

I cost it and work out the exposure

Real annual cost per tool including the seats nobody uses, plus what each one touches: which data leaves your network, under whose terms, with what retention, and whether anything is training on it. Overlaps get grouped so you can see where you are paying twice for the same capability.

03

Every line gets a verdict and a reason

Keep, kill or rebuild, written down per tool with the saving or the risk attached, ordered so the easy cancellations come first. Plus the things nobody is using that you are still paying for, which is normally the fastest money in the whole document.

1 · WHERE THE SPEND ACTUALLY HIDES card statements SSO and identity logs keys in your repos extensions, jobs asking each team 2 · ONE TABLE, COSTED AND CHECKED TOOL PER YEAR SEATS USED DATA IT TOUCHES a coding assistant, engineering paid yearly most of them your source code a writing tool, on somebody's card monthly four of twenty drafts and campaigns a vendor bot, support per resolution n/a customer messages a key in a nightly script, owner left metered nobody whatever it reads 3 · A VERDICT ON EVERY LINE KEEP it earns its money here is what it does and what to watch KILL nobody opens it or it duplicates one you already pay for REBUILD renting it stopped making sense at your volume, here is the cost of owning it FIX NOW data is going where your own policy would not allow it to goOrdered so the painless cancellations can happen the same week, and the data finding does not wait for a budget cycle. Rows shown are the shape of the thing. Yours come out of your own statements, logs and repositories.
Everything gets found first, from the places spend actually hides, then costed and checked for what data it touches. Every line leaves with a verdict and the reason behind it, ordered so the cheap wins come first.

What you get

One inventory, with a number and a verdict on every line.

One fixed price for all of it, handed over as a document your finance and security people can both read. There is nothing to subscribe to afterwards and no replacement product waiting at the end of it.

Find

The full inventory

  • Every paid tool, from the ones in procurement to the ones on a personal card, traced back from statements and vendor invoices rather than from what anyone remembers
  • Every API key in use, found in repositories, secret stores and environment config, recorded by where it lives and what calls it. The inventory never carries a key value, only its location, its owner and whether anything still uses it
  • Every integration and extension, including the browser plugins and the app-store connectors somebody approved once and nobody revisited
  • Who actually uses what, from seat counts against real activity, because a twenty-seat licence with four active users is a very common line item
  • The things still running with nobody behind them: a departed employee’s key, a scheduled job, a workflow in a tool nobody logs into any more
Cost

What it is really costing you

  • Annual cost per tool, normalised to one currency and one year, so a monthly card charge and an annual invoice sit in the same column
  • Seats and usage against spend, which is where the unused licences surface
  • Model and API spend separated from subscription spend, because they move for completely different reasons and get cut in completely different ways
  • Overlap groups, where two or three tools are paid for the same job, with what consolidating onto one would save
  • What each tool touches: which data goes to it, under which terms, with what retention, and whether anything is being trained on
Decide

Keep, kill or rebuild

  • Kill, with the saving attached and the cancellation path, ordered so the painless ones can be done the same week
  • Keep, with what it is genuinely doing for you and what to watch, because some of these really do earn their money
  • Rebuild, where you are renting something at a price that stops making sense at your volume, with a rough cost of owning it instead
  • Consolidate, naming which of the overlapping tools survives and what it would take to move everyone onto it
  • Fix now, for anything where data is going somewhere your own policy would not allow, flagged separately so it does not wait for the next budget cycle

What this will not do.

This is an inventory and a set of verdicts, not an implementation. I do not cancel anything, migrate anyone or renegotiate your contracts: the document tells you what to do and your people do it, because the access to actually cancel things is not access I want. It is also not a security audit or a compliance certification. I will tell you that a tool sends customer records to a third party under terms nobody has looked at since, which is usually the finding that matters, but a formal assessment against a framework is a different profession and I will say so rather than pretend. And I can only find what is findable: a tool paid in cash with no invoice and no login trail will not appear, so the inventory is honest about the places it could not see.
From $4,000one engagement · from two weeks · whole company

$4,000 covers a company we size at the scoping call: how many people, how many teams, how many places purchasing happens. A head office with forty teams and four finance systems is more discovery than a single office of sixty: it costs more and it takes longer than two weeks. Both numbers get quoted at scoping, before you commit, rather than discovered halfway through.

One price for the whole audit: the discovery, the costing, the data exposure review and the written inventory with a verdict on every line. The cheapest engagement I offer, deliberately, because the first thing it usually produces is a cancellation list worth more than the fee. No percentage of what you save, and nothing to buy afterwards.

  1. 1

    Discovery $1,500

    Statements, invoices, identity logs, repositories and secret stores, extensions and scheduled jobs, plus a short conversation per team. Output is the raw inventory, including the shadow spend.

  2. 2

    Cost and exposure $1,500

    Annual cost per tool, seats against real usage, model spend separated from subscriptions, overlap groups, and what data each one touches under whose terms.

  3. 3

    Verdicts and handover $1,000

    Keep, kill, rebuild or consolidate on every line with the reason and the number, ordered by how easy it is to act on, plus a walkthrough with whoever signs the cancellations.

Each milestone is agreed before it starts and paid only when you approve its deliverable. If the inventory at milestone one already tells you what you needed, you can stop there and keep it.

Why this one tends to pay for itself

The cancellation list arrives before the invoice does.

Unused seats are the usual first find

Tools get bought for a team of twenty during a push and keep billing for twenty long after four people still open them. Nobody notices because the charge is stable and stable charges stop being read. Seat counts against real activity is a boring exercise that routinely finds more than this engagement costs.

Nobody owns the overlaps

Two departments solve the same problem six months apart with different vendors, and neither purchase was wrong at the time. The duplicate only becomes visible when somebody puts every AI line item on one page, which is a thing that has usually never been done.

The data finding is the one you cannot price

Somewhere in most of these there is a tool quietly receiving things it should not, under terms that were agreed once and never revisited. It costs nothing to fix once you know, and a great deal to find out about any other way.

I am not selling you the replacement.

You should assume a conflict of interest, because there is one: I build AI systems for a living, and rebuild is one of the verdicts on the list. So the rules are written down. A rebuild verdict only appears where the maths is on the page and you can check it, with the cost of owning the thing compared against what you currently rent. Where a tool you already pay for is genuinely the right answer, it says keep. Where the right answer is cancel and replace with nothing, it says that too, and that is a common outcome. You owe me nothing after milestone three, and taking the rebuild list to your own team or anyone else is a completely normal thing to do with it.

The inventory is yours.

🔓

A document you keep and re-run

The inventory, the costs, the overlap groups, the exposure notes and the verdicts, handed over in a form your finance and security people can both work from. It is also the baseline for next year, so the second time anyone asks what you spend on AI there is an answer. My open-source work is on my GitHub, including the self-hosted gateway behind any line that comes back saying rebuild.

🏠

Read-only, and nothing leaves

I need to see, not to change. Read access to billing, identity and repositories, revoked when it is over, and nothing gets exported for analysis. No tool of yours gets touched, no setting changed, no key rotated by me. Key values are never recorded, copied out or written into the report, which lists a credential by where it lives and what calls it, so the document stays safe to hand to finance. NDA signed before specifics if that is your policy.

🛡

Paid in three phases, never up front

Each milestone is agreed before it starts and paid only when you approve its deliverable. Direct B2B, on your own contract and invoicing, with no platform in the middle.

∞

No percentage of the saving

A flat fee, not a cut of what you cancel. Billing against savings quietly rewards me for finding expensive problems, and you should not have to wonder about that while reading the kill list.

Straight answers

What does the price cover?

Two weeks in three milestones: discovery across billing, identity, repositories, secret stores, extensions, scheduled jobs and a short conversation per team; annual cost per tool with seats measured against real usage and model spend separated from subscriptions; what data each tool touches under whose terms; overlap groups; and a written inventory with keep, kill, rebuild or consolidate on every line, ordered by how easy it is to act on. From $4,000, set against the size we agree at scoping, whole company.

How does payment work?

In three phases: discovery ($1,500), cost and exposure ($1,500), verdicts and handover ($1,000). A phase is agreed before it starts and paid when you approve that phase’s deliverable, so you are never paying up front for work you have not seen. If the raw inventory at phase one is already the thing you needed, you can stop there and keep it.

How is this different from your AI Build Plan?

Opposite directions. The AI Build Plan looks forward: one department, three weeks, what you should build that you have not built yet. This one looks backward at what is already running everywhere, what it costs and what to switch off. Companies that have spent money without a plan usually want this one first, because it is cheaper, faster, and it frequently funds whatever comes next. Doing both is normal and they are quoted separately.

We do not think we have that much. Is it still worth it?

That belief is the common case, and it is the reason the number is usually a surprise. If the audit genuinely finds a tidy, well-owned, non-overlapping set of tools, you get that in writing, which is a real answer to give a board that keeps asking. But the version where a company expects to find four tools and discovery turns up eleven is the common one.

Will you find things that embarrass people?

Probably, and how that is handled is agreed before I start. The default is that the document describes tools and spend rather than naming who expensed what, because the point is to fix the spend and not to run a disciplinary process. If you want it attributed, say so up front. Either way people are much more forthcoming when they know the answer is not a punishment, and the quality of the inventory depends on that.

What do you need from my team?

Finance exports or card statements covering the last twelve months, read access to your identity provider and whatever billing consoles exist, read access to repositories and secret stores, and a list of teams plus someone in each who can spend fifteen minutes telling me what they actually use. Plus one person who can chase a statement line when nobody recognises the vendor name, which always happens at least once.

Is this a security audit?

No, and I will not dress it up as one. I report what data each tool receives, under whose terms, with what retention, and whether anything is training on your content, because that falls out of the inventory and it is usually what somebody needed to know. A formal assessment against a framework, a penetration test or a compliance certification is a different profession, and you should hire someone who does that.

Do you cancel things or move us off them?

No. The document says what to cancel, what it saves and how to go about it, then your people do it. Cancelling, migrating and renegotiating need write access and authority over your vendor relationships, and I do not want either. If a rebuild verdict turns into work you want done, that is a separate engagement quoted then, and giving it to someone else is a normal outcome.

What if the answer is that everything should stay?

Then that is the report, with the reasoning per line, and you have a documented inventory and a defensible answer about your AI spend. It is the less common outcome but it happens, usually at companies that already did a procurement sweep. If that looks likely from the scoping call I will say so before you pay anything, rather than take the fee and hand back a list that only confirms what you knew.

How do we actually engage?

Direct B2B, on your own contract and invoicing, through whatever procurement process you already have. There is no platform in the middle and no marketplace fee. Reach me on LinkedIn, tell me roughly how many people you have and how the spending is organised, and we sort the terms directly, including an NDA first if that is your policy.

Tell me how many cards the AI is on.

This is for companies that bought AI faster than they organised it, and now cannot answer what it costs, who owns it, or where the data goes. Tell me roughly how many people you have, how purchasing works, and which tools you already know about. We get on a call, I scope it, and two weeks later you have the full list with a number and a verdict on every line.

Get in touch →

Direct B2B, on your own contract and invoicing. Reach me on LinkedIn and we sort the terms. Fixed price, three milestones, no percentage of what you save.