Employees are sending data to unsanctioned AI apps that bypass the AI gateway
- 1Detected
- 2Investigating
- 3Remediation Available
- 4Remediated
Detected · reported to AISPM
AISB Shadow AI Discovery matched 5 unsanctioned AI apps across 34 users in the last 30 days of gateway and egress logs.
Source: AISB · Shadow AI Discovery · — · simulated signal
Open Shadow AI Discovery in AISB ↗Evidence
Unsanctioned apps
Review the Unsanctioned apps evidence. Open an app row to see why it scored as it did.
| App | Category | Users | Requests | Risk |
|---|---|---|---|---|
| DeepSeek (chat.deepseek.com)DeepSeek | Consumer chat assistant | 3 | 211 | 83Critical |
| Character.AICharacter Technologies | Consumer chat assistant | 5 | 640 | 79Critical |
| PoeQuora | Consumer chat assistant | 7 | 902 | 48Medium |
| Perplexity AIPerplexity | Research / search assistant | 5 | 488 | 40Medium |
| ChatGPT (Consumer/Free)OpenAI | Consumer chat assistant | 14 | 2,310 | 36Medium |
Risk scores come from AISB's App Risk Catalog — a representative scoring model (higher = riskier), not a certified audit.
Discovery runs continuously; findings arrive as they are matched, with a monthly summary report.
Confirm & Escalate
Complete steps 1 and 2 to enable this.
Recommended remediation. Blocks direct access to the five consumer AI endpoints, requires SSO access to the sanctioned AI gateway, revokes personal API keys found in egress, and re-runs discovery.
Confirm & Escalate moves this finding to Remediation Available and unlocks the playbook “Route AI usage through the sanctioned gateway” (4 steps). Nothing runs until you click Execute Playbook. Simulated in this demo: nothing is changed or sent to any system.
- 1.Block consumer AI endpoints at the web gatewayRuns on: Secure web gatewayDirect requests to the five matched consumer AI apps are denied. Reversible by removing the rule.
- 2.Require SSO-only access to the sanctioned AI gatewayRuns on: AISB (AI gateway) access policyOnly signed-in employees can reach the sanctioned gateway, so AI use is attributable and logged.
- 3.Revoke personal API keys found in egressRuns on: Identity provider / key vaultPersonal keys seen in outbound traffic stop working. Users must request sanctioned access.
- 4.Re-run Shadow AI discovery to confirm clearanceRuns on: AISB Shadow AI DiscoveryA fresh discovery pass is requested. The clean result shown here is simulated.