VitalSec platform

ShadowAI

AI discovery, policy & control

Find AI tools. Apply your policy. Take action.

Find AI software on the devices your organization manages. Decide which tools are allowed, remove or block prohibited AI software where supported and authorized, and check the result.

Find AI across your environment

You cannot govern what you cannot see.

ShadowAI checks installed software, not what people type into AI tools. It identifies supported AI applications and developer tools on managed devices—without reading prompts or capturing prompt content. Each finding shows where the tool was found so your team can decide what to do.

Know what is installed—and where

Installed software is the starting point. Your organization’s policy determines whether its use is allowed; an installation alone does not prove how someone uses it.

Check devices

See what software is installed

Recognize AI

Match installed software to known AI tools

Apply your rules

Review the device, owner, and policy

Keep the record

Record the finding and your decision

Discover. Govern. Enforce.

Your AI policy should lead to action.

Identify the tool and device, apply your policy, and choose the appropriate response. The control scope includes blocking prohibited AI use and removing unwanted software through supported endpoint or provider integrations. Available actions depend on the tool, device, integration, and your organization’s authorization. Customer-authorized desktop removal has been verified in a controlled deployment; broader blocking and removal coverage is being developed.

Discover

Find the AI tools.

See which supported AI tools are installed on the devices your organization manages.

Policy

Apply your organization’s rules.

Mark AI use as allowed, prohibited, or needing review. Record who is responsible and any exception your organization has approved.

Understand

See how the tool operates.

See whether a tool connects to a cloud service or runs on your own computers. Some developer tools can do either, depending on their settings.

Act

Address prohibited use.

Remove or uninstall supported AI applications when your policy prohibits them. Blocking and removal options depend on the tool and the systems you have connected. Your organization authorizes the action before it runs.

Registry coverage

The AI tools ShadowAI recognizes.

The current ShadowAI registry covers 33 distinct AI services through 38 active detection entries. Some tools have more than one software package or name, so one service can have several detection entries.

distinct AI services

active detection entries

Cloud and desktop AI

ChatGPT DesktopClaude DesktopMicrosoft Copilot DesktopGemini DesktopPerplexity DesktopLe Chat by Mistral

Local and self-hosted

OllamaLM StudioGPT4AllJan.aiLocalAIText Generation Web UI

Developer and agent tooling

GitHub CopilotCursorCodeiumContinue.devClaude CodeLangChainOpenAI SDKsAnthropic SDKs

Detection coverage is broader than removal support. Finding a tool does not mean ShadowAI can remove it.

Your rules, clearly applied

Allowed, prohibited, or waiting for review.

Approved use

Your organization’s policy allows this tool.

Policy decision needed

The tool is installed, but your team still needs to decide whether to allow it.

Use prohibited

Your policy prohibits this use. Your organization must approve any action taken.

From finding the tool to proving the change

Take action. Check the result. Keep the proof.

ShadowAI can remove or uninstall prohibited AI software where that action is supported and customer-authorized. It then checks fresh device evidence to confirm the software was removed or the approved change took effect, records the outcome, and keeps it connected to the original finding and policy decision.

Observe

Identify supported AI tools from verified device software inventories.

Decide

Apply your AI-use policy, including ownership and approved exceptions.

Act

Remove or uninstall prohibited AI software where supported and customer-authorized, or apply another approved response.

Validate

Check the device again to confirm the software was removed or the approved change took effect.

Prove

Keep a record of what was found, what you decided, what changed, and the follow-up check.

Measure

Use the latest findings in VitalSec’s risk measurement.

Evidence that survives the decision

The finding, decision, action, and follow-up stay connected.

Evidence Continuity can keep the original finding, your policy decision, any approved exception, the action taken, and the follow-up device check together. Your team can review what happened without piecing the history back together.

See how Evidence Continuity preserves the record

Software found
Source, device, package, and time stay attached.
Policy decision
Policy state, owner, and exception context stay visible.
Approved change
VitalSec records what was approved and what it tried to change.
Follow-up device check
New evidence shows what is true after the change.
Evidence Continuity record
The connected history can be verified and reused.

Keep the record for future reviews and audits.

Bring AI use into the same evidence system

Find AI. Enforce your policy. Verify the outcome.

See which AI tools are present, apply your policy, remove or block prohibited tools where supported, and keep the evidence showing what happened.

Get started Talk to Jim