Discover

Seven ways to discover the AI tools and use cases across your organisation — use one or combine them

AI Voice Interview

Voice-interview any employee. The AI agent asks about their AI tools and autonomous agents, and documents each use case straight from the conversation.

Start Voice Interview

MCP Server Discovery

Scan endpoint configs for Model Context Protocol servers — see what employees have wired into Claude, Cursor and VS Code, with transport, auth and permission risk.

Scan MCP Servers

Defender Screenshot Import

Upload a screenshot of the shadow-app list from Microsoft Defender for Cloud Apps. The agent extracts the applications, enriches each one, and adds them to your inventory.

Import Screenshot

Integrations

Connect to your existing systems — Entra-ID, your SaaS estate and CASB — to auto-detect ungoverned AI tools the moment they appear.

12 new

Applications Insights

Always-on agents on endpoints, desktop apps and the browser extension. AI usage is observed in real time and use cases surface automatically — no outreach, no waiting.

AI Discovery Campaign

Send AI agents to interview every department. Agents ask about AI tool usage, data handling, and risk exposure.

Employee Self-Registration

Share a link with staff. An AI agent interviews them conversationally and extracts use case data automatically.

AI Tools Discovered

Vendors in Use

Use Cases Identified

Shadow AI Detected

Agent Conversations

Sample data

Sarah Chen

Legal

Complete

Hi Sarah — I'm helping your security team understand how AI is being used across the organisation. Are you currently using any AI tools in your daily work?

Yes, we use ChatGPT for drafting contracts and summarising legal briefs.

Thanks! Does the contract text include any client-confidential information such as names, deal terms, or financial data?

Yes, client names and deal terms are included.

Got it. Who reviews the AI output before it's used — or does it go directly into documents?

I always review it, but junior associates sometimes use it directly.

✓ Use case extracted: Contract Review AI · GPT-4o · Confidential data · Owner: Sarah Chen

James Okafor

Complete

Hi James — quick question from the security team. Is your engineering team using any AI coding assistants or automation tools?

Yes, GitHub Copilot for the whole team, and some people use Claude for code reviews.

Does Copilot have access to any proprietary internal codebases or API keys in the repo context?

It has access to our internal repos yes, including some that have config files.

✓ Use case extracted: Code Assistant · GitHub Copilot · Internal codebase · Owner: James Okafor

Priya Sharma

Complete

Hi Priya, the security team is conducting an AI use case review. Does HR currently use any AI tools for recruitment or employee management?

Yes — we use an AI tool to screen CVs and rank candidates. Also using ChatGPT for writing job descriptions.

The CV screening tool — does it process any protected characteristics data like age, nationality, or gender from the CVs?

The CVs often include photos and dates of birth. We haven't configured it to ignore those.

✓ Use case extracted: CV Screening · AI Classifier · Sensitive personal data · Owner: Priya Sharma · HIGH RISK: Bias

Michael Torres

Finance

Complete

Hi Michael — I noticed ChatPDF was accessed from your machine using your corporate credentials. Are you using this for work purposes?

Oh yes, I use it to read client contracts and financial reports. It's much faster than reading the full PDFs.

Are those documents confidential? And was this tool approved by IT?

They're definitely confidential... I didn't know I needed approval. I just googled a tool that worked.

✓ ⚠️ Shadow AI detected: ChatPDF · Confidential contracts uploaded to unapproved external service · Owner: Michael Torres

Emma Fischer

Claims

Complete

Hi Emma — I'm mapping AI tools used in Claims. What AI systems does your team currently use in claims processing?

We have a fraud detection model, an AI for damage assessment from photos, and we auto-generate claims letters.

The fraud detection model — has it been tested for bias across customer demographics like age or ethnicity?

We had one audit last year but I'm not sure the results were actioned. It's been flagged a few times.

✓ Use case extracted: Fraud Detection Model · Critical bias risk flagged · Owner: Emma Fischer

Marco Rossi

Finance

Complete

Hi Marco — as CFO, I want to understand what AI tools Finance is using for reporting or forecasting. Can you help?

We use GPT-4 to help generate board reports and budget forecasts. I review everything before it goes out.

Are financial figures fed directly into the AI prompt, or does it only work with aggregated/anonymised data?

Full P&L data goes in. We haven't thought about whether that's a risk.

✓ Use case extracted: Report Generator · GPT-4o · Restricted financial data · Owner: Marco Rossi

Tom Bradley

Underwriting

Complete

Hi Tom — I'm reviewing AI use in Underwriting. What AI systems are in use for risk assessment or pricing?

We have a risk assessment model and an LLM that explains pricing decisions to customers.

Does the risk assessment model use any customer demographic data like postcode or occupation that could create protected characteristic proxies?

Yes it uses postcode which I know can correlate with ethnicity. It's been flagged by our actuaries.

✓ Use case extracted: Policy Risk Assessor · Critical bias risk (postcode proxy) · Owner: Tom Bradley · EU AI Act gap

Lisa Wang

Risk & Compliance

Complete

Hi Lisa — as CRO, you're well placed to help. What AI tools does Risk & Compliance use, and are you aware of any ungoverned AI elsewhere?

We use AI for sanctions screening, regulatory monitoring, and risk scoring — all properly governed. But I know some teams are using ChatGPT informally.

Can you name any specific departments or tools you've noticed being used informally?

Finance uses some PDF tool I don't recognise, and I heard HR is using an AI for CVs without proper vetting.

✓ Shadow AI leads: ChatPDF (Finance) · CV Screening tool (HR) · Referred for investigation