01Detect
Seen, then rolled up
Microsoft Copilot arrives as six separate signals from two sources, and becomes one row — not six.
28 detections28
Endpoint agent17Source control11
You can’t govern AIyou can’t see.
AI is being adopted across your organization — through SaaS tools, APIs, models, and agents — often without security or governance knowing. Strai8 discovers these systems, identifies their owners and risk, and turns unknown AI activity into governed, auditable systems.
01The problem
AI adoption moves faster than your governance process
Employees adopt AI through SaaS tools, APIs, open-source models, and agents long before those systems make it into your approved inventory. Without visibility, there is no owner, no risk decision, and no accountability.
No decision on record
Distinct AI tools—
With a decision—
With an owner—
One standing decision each
Distinct AI tools18
With a decision18
With an owner18
ClaudeApproved
GitHub CopilotApproved
Google GeminiRestricted
CursorApproved
PerplexityUnder review
DeepSeekProhibited
Mistral AIUnder review
OllamaRestricted
Hugging FaceApproved
PyTorchApproved
Notion AIRestricted
TensorFlowApproved
LangChainApproved
ElevenLabsProhibited
scikit-learnApproved
n8nUnder review
NVIDIAApproved
Weights & BiasesApproved
One decision per tool, per organisation
01 — DiscoveryAI is adopted outside the approval flowAI enters through browser-based SaaS, developer APIs, local models, and embedded agents. Traditional application inventories rarely capture it.
02 — OwnershipUnknown systems have no accountable ownerWhen an AI system isn’t registered, security doesn’t know who uses it, what it does, what data it touches, or who is responsible for it.
03 — GovernanceNo record means no decisionWithout a documented decision, security can’t consistently approve, restrict, prohibit, or review an AI system — leaving shadow AI outside governance.
02Discover
Discovery runs where AI actually enters. Not where you thought to look.
47Discovery signals
Endpoint agent17AI processes, applications, models, and runtime activity across laptops and servers
Source control11AI imports, model files, dependencies, and repositories entering the development workflow
Cloud & API gateways8AI services, API traffic, and external model endpoints used across the organization
Identity & access6Accounts, applications, and permissions connecting users to AI systems
Network telemetry5DNS, proxy, and network signals revealing AI services already in use
19AI systemsCorrelated from multiple signals
AI doesn’t leave a single signal. Strai8 correlates endpoint activity, source code, network traffic, identity, and cloud signals to identify the AI systems actually running across your organization — even when no one has declared them.
Explore Shadow AI Discovery03The work
From an unowned detection to a governed asset, in four moves
Discovery is the easy half. What makes a tool governed is a recorded decision, an owner, and a step somebody can close. This is one tool, all the way through.
02Decide
One decision, four exits
Somebody sets Microsoft Copilot to Approved. The decision is stored against the tool, for the whole organisation.
Block records the decision and rewrites every open alert. It reaches nothing on a device.
Microsoft Copilot
ApproveDrops off the shadow list
RestrictAllowed, with conditions
ProhibitEvery open alert escalates
ReviewWaits on a named owner
03Register
The row becomes a record
Microsoft Copilot stops being a detection and becomes an asset with an owner, an environment and a review state.
SystemReviewRiskOwner
Microsoft CopilotShadowApproved—MediumUnidentifiedNamed, with a role
04Resolve
A step somebody can close
The mitigation agent writes what to do about Microsoft Copilot, who owns it, and the condition that closes it.
What to do next
EffortLow
OwnerIT operations, by role
Evidence3 attached
Done whenDone when the review is signed off and the shadow bucket reaches zero.
04Trace
See the full picture, from tool to impact
Every finding is connected to its owner, its data, the systems it reaches, the policy it breaks and the frameworks that follow — so you understand the risk before you decide.
Compliance & FrameworksUnrecognised AI assistant
Prohibited8.6/ 10
Risk score · High
01Who was using it
One accountin Engineering
- EngineeringOne account, no owner assigned
it authorised through that account, so the account’s read scope became the tool’s
02What it reached
4 systems
- TicketingRead access · connected app
- Shared driveRead access · same app
- Object storageai-docs-prod
- RepositoryOne service imports it
those four systems are where the work lives, so that is what went into the prompts
03What it read
4 data categories
- Customer recordsPersonal data
- ConversationsChat logs
- Internal documentsProprietary
- Usage analyticsBehaviour data
one of those categories is personal data, and the tool is not on the approved list
04What that breaks
AI tools policy
- Prohibited toolsUnapproved assistants may not hold personal data
a prohibited tool holding personal data fails a control in every framework you score
05What it costs you
8 controlsacross 4 frameworks
- CSA AICM v1.0.34 controls
- ISO/IEC 42001:20232 controls
- NIST AI RMF 1.01 control
- EU AI Act 2024/16891 control
Get started
See what AI is already running.
Find the AI tools, models, APIs, and agents already operating across your organization — and turn unknown AI into governed AI.