Shadow AI · AI DLP

The next leak won’t be an attack.
It will be a prompt.

Your people already paste source code, customer records and contracts into AI tools you never approved. Banning AI does not work. Govern it instead.

Book the session →Secure Web Gateway →

AI visibility & control · LiveCASB app control · LiveDLP for AI prompts · Coming soon

Shadow AI

Most of it happens in a browser tab.

Employees paste prompts, source code, financial figures or even customer data into AI tools to get the job done faster. Not out of malice: because it works. Classic firewalls were never built to tell a chatbot from any other website, and a policy on paper does not stop a copy and paste.

AI applications can make systems more permeable in many ways. While you try to protect data, information often flows out in uncontrolled ways, which creates risks.

Group COO, financial services company

How it works

See it. Decide it.
Stop what must never leave.

Governance starts with visibility. The Secure Web Gateway puts AI services into their own category, chatbots, content generators and code assistants, so AI use becomes a policy decision instead of a blind spot.

browser · new tab

chat.example-ai.comUnapproved AI service

Summarize this for the board: customer_records_Q3.xlsx plus the pricing terms from contract_final.docx, short and punchy.

Upload stopped by policy

SeeEvery AI service in useAI traffic gets its own category: chatbots, content generators, code assistants. Live.
DecideAllow or block, per groupFor all employees or for specific groups, approved tools stay open. Live.
RestrictStop risky uploadsCASB policy restricts uploads to unsanctioned services. Live.
ReadInspect the prompt itselfData loss prevention for AI prompts. Coming soon.

Illustrative.

Why banning fails

Banning AI does not work.
Govern it instead.

A ban just moves the traffic to private phones, out of sight and out of policy. That is why we see AI tools mostly allowed in our customers’ policies: businesses find them useful. The goal is governance, not a wall.

Visibility first: see how much traffic goes to AI tools in your service statistics.
Policy per group: block AI tools for all employees or only for specific groups.
Approved tools stay open: block whole categories of unsanctioned AI apps while vetted ones keep working.
Risky operations restricted: CASB policy can restrict uploads to unsanctioned services.
A softer lever: a Warn action makes users acknowledge the data risk before they continue, as described in Keeping Pace with AI.

Straight answers on status

What is live, what is coming.

AI category in the Secure Web GatewayLiveChatbots, content generators, code assistants as one policy category, for every SWG customer CASB discovery and app controlLiveRisk scores for over 9,000 cloud applications, usage visibility, upload restrictions JanusLiveTriages what the gateway caught, risky SaaS included

Data loss prevention for AI promptsComing soonInspect what goes into a prompt and stop what must never leave

Until prompt-level DLP ships, the controls above decide who may use which AI service and what may be uploaded to it. We would rather say that plainly than sell you a demo.

Straight answers

Questions, answered.

Do you read what my employees type into AI tools?

Not today. The Secure Web Gateway sees which AI services are used and enforces your policy on them, and CASB can restrict uploads. Data loss prevention for AI prompts is coming soon.

Is the AI category included?

Yes. It is live for every Secure Web Gateway customer. To change the action, open a Mission Control ticket. Release note

Can we allow AI and still keep control?

Yes, that is the point. Keep vetted tools open, block unsanctioned ones per group, and use the Warn action as a soft lever where a hard block would only push people to their phones.

Does this cover AI agents, not just chatbots?

Our blog describes subcategories for generative AI and for AI agents, including MCP servers, so that you can see how much traffic is generative and how much is agentic. Keeping Pace with AI