Play · Security teams
Lock down AI on managed laptops
See the AI tools onevery enrolled device,then set the policy.
Deploy the endpoint agent through the MDM you already run. By the end of the week you know the AI tools on every enrolled device, which accounts they use, and each one has a policy. People keep the tools they need while you decide.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF
- This play uses
- 01Discover
- 03Enforce
- 05Prove
Who
A security team with a few hundred managed devices and no inventory of the AI running on them.
What happened
An employee pasted a customer list into a personal ChatGPT account, and nobody could say how often that happens.
What's at stake
Data leaving through personal AI accounts and unvetted extensions, with no record to show an auditor, a customer, or a regulator.
- 01Discover
Deploy once, see what runs.
The endpoint agent ships through Jamf, Kandji, Intune, Hexnode or your RMM. Within hours it reports every AI desktop app, coding agent and browser AI session per device, the account type in use (personal, corporate or unknown), and which AI hosts each one reaches. The Shadow AI report is the inventory you never had.
AI apps, coding agents and browser AI · macOS and Windows · Chrome, Edge, Firefox
endpoints · shadow AI report
- 02Enforce
Policy per tool, not per person.
Once the agent and extension are installed, browser AI conversations are captured and uploaded by default, with secrets redacted on the device first. An admin turns Browser capture off on the Global layer to keep them on the device, and a team, app type or device can override it. Browser DLP checks prompts and uploads as they leave, and a paste that matches a credential, a card number or a pattern you add gets a warning or is stopped before it sends. A vendor or app nobody approved is blocked outright.
browser DLP: warn or block · block by vendor, site or app · quarantine a device from the console
endpoints · needs attention
- 03Prove
The report writes itself.
Every observation and every block is a decision with the policy that made it. Export the shadow AI report for leadership, or a compliance pack mapped to the controls your auditor asks about.
Per-device evidence · signed compliance packs
insights · compliance pack
- ChatGPT · personal account · paste 2,140 charsendpoints · m.chen-mbp · customer PII detected (names, emails)block
- Claude Code · session startendpoints · j.lee-win · corporate account · capture onallow
- ai-writer-pro · consumer AI appendpoints · r.ortiz-mbp · vendor not on the allowed listblock
Illustrative entries in the shape the product writes them.
Products in this play
Not by hand. The agent deploys through your MDM and the browser extension is force-installed by policy, with no prompt and nothing to opt into.
Run this play this week.
Free for your first agents and devices, live in about thirty seconds. Or walk through it with someone who has run it before.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF