See the tools already in use.
Discover supported browser assistants, desktop apps, and local MCP tools on enrolled devices. Connect activity to users and devices.
See application and device records →Solutions / Shadow AI
Discover and govern employee AI use.
Find supported AI tools on employee devices, set application policies, and protect sensitive information before it is shared. Connect approved assistants to your gateway when you need model access and budget controls.
Delivered through Cortega Endpoint Guard.
Shadow AI / What you can do
Bring employee AI use into your governance program.
Choose how each app is handled.
Observe usage, apply local guardrails in police mode, or block an app. Configure inspection for the domains your organization chooses to govern.
Explore local policy controls →Govern approved assistant traffic.
Configure supported assistants to use AI Border Gateway for model access, routing, budgets, and shared observability.
Explore deployment and gateway coverage →Local protection
Set the policy for each application.
Detect, mask, or reject.
Apply local detectors for personal information, healthcare data, and credentials to configured requests and responses. Start with an industry pack and add patterns for your organization.
Choose what is inspected.
Observe mode inspects and reports configured app domains; police mode adds local guardrails. Other domains remain encrypted. Recording and analysis are separate configuration choices.
Define connection-loss behavior.
Local guardrails continue without a cloud call. AI traffic continues by default when Cortega cannot be reached; choose a stricter block-on-failure posture when required.
In the console
Manage applications, guardrails, and enrolled devices.
From the Cortega console.
Optional analysis and verification
Understand AI use and check its answers.
Local guardrails protect configured interactions on the device. Enable Cortega Agents and AI Verifier separately when you also need analysis of recorded traffic or response checks.
01
AI Signals for your team
Analyze selected endpoint traffic for sentiment, escalation, policy compliance, topics, cost, efficiency, and agent trajectory. Configure the rubric for compliance analysis and choose the traffic each enabled agent may read.
02
Verification for employees
Check policy violations and legal citations, and evaluate factual relevance and contextual accuracy. When AI Verifier reviews device traffic, its desktop app can notify the employee about a flagged answer.
Explore verification and Cortega Agents →03
Control inspection and recording
Only configured application domains are decrypted for inspection; other domains remain encrypted. Set recording, data-handling, and retention policies, then explicitly enable the traffic sources available for analysis.
Read about analysis controls →Deployment and connected coverage
Roll out with a clear policy.
01
Start with a pilot or managed fleet
Use self-service enrollment for an administrator-managed pilot or MDM with per-device certificates for a managed fleet. Choose the apps to govern, configure local guardrails, and review enrolled devices.
Read the deployment guide →02
Connect employee and production AI
Endpoint Guard covers configured employee applications. AI Border Gateway governs routed model and MCP calls, with model access, budgets, and shared observability. Gateway budgets apply to routed traffic.
Explore AI Gateway →How it works
Endpoint Guard architecture
The Shadow AI solution is delivered primarily through Cortega Endpoint Guard, our product for discovering and governing AI use on employee devices.
This diagram shows the macOS Endpoint Guard architecture. A native agent applies application policies and local guardrails on employee devices. Supported assistants can also be configured to send model calls through Cortega AI Border Gateway.
Inspection, recording, and optional analysis
Observe and police modes inspect configured app domains. Police mode adds local guardrails; each guardrail can log, mask, or reject content on requests, responses, or both. Domains outside inspection scope remain encrypted.
Set recording and data-handling policies for endpoint observability. AI Verifier and Cortega Agents are enabled separately for selected traffic; they are not part of the local guardrail execution path.
Shadow AI
See the AI use you cannot see today
Start with the devices, the AI apps in use, and the data you need to protect.