OCI DOMAIN FOUR
Find what your people are really using, and take control of what it can see.
Applications bought on expense cards, staff pasting company data into AI tools, and accounts that outlive the people who held them. We help your team find, count and govern what is in use, so the exposure stops building up in the background.
What technology leaders say about working with us.
Scott is one of those rare professionals you encounter only a few times in your career.
Working with Scott and Jonathan is a refreshing experience and one I hold out as metric when dealing with vendor partners.
Chris ZitoInformation Technology Security Manager
Working with Jonathan and Rullan Scott Technologies has been an exceptional experience.
Bladimir GonzalezWestgate ResortsThe risk of tools nobody has counted
No single purchase triggers scrutiny. The exposure builds from hundreds of small decisions, and it surfaces as wasted spend, orphaned access, or company data in places nobody can name.
AI is where this is growing fastest. Staff are pasting contracts, pricing and customer records into free tools adopted by individuals, not departments. When a customer or a regulator asks where that company data went, nobody can answer, and what has already been submitted cannot be taken back.
Leavers are where it becomes concrete. A leaver process built around your core systems silently misses everything bought outside it. If 40 people leave a year, each keeping access to three unmanaged applications, that is 120 live credentials belonging to people who no longer work for you, on systems IT was never told about.
Unused licences leak money more quietly. Departments buy on expense cards and IT finds out at renewal. Eighty unused seats at £40 a month come to £38,400 a year, repeated every year the gap goes unchecked, across every tool in the estate.
Where you are now, and where you can be
Where most organisations are today
- Nobody could list every application in use today.
- Staff use AI tools and nobody tracks which data goes in.
- Leavers keep access to systems outside the leaver process.
Where you can be
- A current inventory exists and is reconciled against real usage.
- AI usage and data handling sit inside a governance framework.
- Offboarding reaches every system, including those bought outside IT.
How we help you govern what is in use
Application inventory
A complete record of the applications in use, built from identity, expense and network data, with a simple way to keep it current.
Procurement route
If the approved route for a new tool is slower than an expense card, people use the card. We design a route that's easier.
Identity and access coverage
Applications move behind central identity, so access is granted and removed in one place.
Offboarding
Access should end when employment does. The leaver process gets extended to every system, including the ones bought outside IT.
AI tool usage and data handling
Which AI services are in use, what data goes into them, and how long is it kept? Once that's clear, practical guardrails go around it.
Licence reconciliation
What you pay for is compared with what is actually used, on a regular review, so the gap stops compounding.
Sample OCI result
SaaS & AI Governance
High Drag
13/ 18
Every domain is scored 0 to 18. A higher score means lower operational confidence.
Get your SaaS & AI Governance score
The Operational Confidence Index turns a vague worry into a number you can act on.
- See your SaaS & AI Governance score out of 18, alongside the other three domains.
- Find out what is running that nobody has counted, including AI tools.
- Get a report you can take to leadership to justify an inventory and a governance policy.
What we usually hear
“We have an approved applications list.”
Most organisations do. The index asks when it was last reconciled against actual usage, and whether the tools adopted in the last twelve months appear on it.
“IT provisions everything centrally.”
That is the intent in most organisations. It is worth confirming against expense data, because departmental purchasing rarely announces itself and is usually invisible until renewal.
“We blocked the public AI tools.”
Blocking at the network edge addresses managed devices on the corporate network. It does not address personal devices, home working, or the AI features now built into software you already license.
“This feels like a compliance exercise.”
It is closer to a cost and exposure exercise. Unused licences, orphaned accounts and unreviewed data processing are commercial problems before they are compliance ones, and they are usually easier to justify fixing on that basis.
Questions about this domain
How is SaaS and AI governance scored in the OCI?
The Operational Confidence Index uses six questions, each scored 0 to 3, giving a domain range of 0 to 18. A higher score means lower operational confidence, so a high score here indicates this is where to start.
Does this cover AI tools specifically?
Yes. The domain covers which AI services are in use, what data is submitted to them, and whether that usage sits inside any governance framework.
We do not think we have a shadow IT problem.
That may be correct, and the index will show it quickly. In most organisations the gap between the expected inventory and the actual one is larger than anyone predicts before they check.
Does Rullan Scott resell SaaS or AI products?
No. There are no manufacturer relationships and no commission behind any recommendation.
What happens after I complete it?
You receive a score, a breakdown by domain, and a report. If you want to talk it through, you can book thirty minutes with a cofounder. There is no follow-up unless you ask for one.
The other three domains
OCI Domain One
Recoverability
Whether your backups restore, how long recovery really takes, and who can run it.
Explore this domainOCI Domain Two
Technology Strategy
Whether renewals, platforms and architecture choices still fit how the business works today.
Explore this domainOCI Domain Three
Network Operations
How the network is really kept running: alerts, change control and cover when people are away.
Explore this domainFind out what is running that you have not counted.
Twenty-four questions across four domains, 5 minutes, and a scored view of where your governance has fallen behind your adoption.
Run the OCI Diagnostic