See which AI tools your team uses.

Shadow AI is the use of AI tools, models or AI-powered features inside an organization without the knowledge or approval of IT and security teams, from ChatGPT in the browser to AI extensions, local LLMs and embedded AI features in SaaS products.

Unmonitored AI usage moves sensitive data outside your control: prompts can contain customer data, credentials or source code, and AI agents can execute actions on internal systems. Without visibility there is no policy, no audit trail and no GDPR/AI Act compliance.

Detection runs entirely on the endpoint, in the network path. AI traffic is classified locally using pre-TLS signals and behavioral fingerprints, no prompts or documents ever leave the device.

Yes. Detection is provider-agnostic and behavior-based, so unknown or obfuscated AI transports are classified without relying on a list of known API signatures.

Because a network firewall only sees traffic that leaves the laptop, and only as an encrypted destination. A local model produces no outbound traffic at all, and a browser AI extension looks like ordinary HTTPS. Detection has to happen on the device, where the process, the payload and the destination are still visible.

Yes. Patronus runs on the endpoint and classifies AI traffic in the local network path, before encryption and before the request reaches your gateway. It covers browser tools, desktop apps, IDE assistants, local models and agents, without per-tool integrations.

Only an endpoint component can see that, because prompts to a local model never cross the network. Patronus captures the prompt on the device, classifies it for PII, secrets and document type, and records the decision in a local audit log. The content itself does not leave the machine.

Three approaches exist: CASB and proxy logs (they see SaaS domains, not prompts or local models), surveys and licence audits (they see what people admit to), and endpoint-level detection (it sees actual usage, including local models and extensions). Patronus takes the third route and builds the inventory from real traffic on the device.

No. Detection works with signals from network traffic and with small, specialized classification models such as Wolf Defender. No prompt is sent to a language model, and Patronus does not generate text itself.

No. The check runs on the device. Only what your rules allow goes to the AI tool you chose yourself. No content goes to Patronus.

No. You keep using your tools as before. Patronus sits on the computer in front of them and makes the usage visible, Protect also checks content and actions.

No. Patronus runs as software on the device in the network path. Traffic takes no detour through third-party servers, and there is no central point that can fail.

Content stays on the device. Only metadata can reach a central view: which tool, which category, which decision. Whether and how that metadata is evaluated is up to your company.

Yes. Detection works on how a connection behaves, not on the provider's name. Local models, internal services and new tools are covered just like the big providers.

No. Detection, inspection and decision run offline on the computer. That includes isolated networks.

The models are built for their task: under 10 ms per detection and under 100 MB of memory. There is no noticeable difference in chat.