Short answer
Yes. Most organisations start with an AI security assessment and shadow AI discovery for one team, then expand.
In detail: Starting Small with AI Security
From there you add prompt and data controls, AI Gateway for your own applications, or MCP server portals for AI agents as the need grows.