Shadow AI
Click 'Shadow AI' in the top-menu to open the 'Shadow AI Discovery' page. On a narrow screen the menu shows icons, and 'Shadow AI' is the eye icon.
Shadow AI gives you DNS-based visibility into the AI services your users reach. It shows which tools are in use (such as ChatGPT, Claude, Gemini, Grok, Perplexity and Harvey, and more than 30 others), how heavily, from which devices and networks, and how many requests are blocked.
Shadow AI reads the DNS traffic that already passes through Secure Internet Gateway, so you do not install anything. Use it to see unsanctioned AI use before you decide whether to block, allow or govern it.
The page is divided into the following areas:
- Summary tiles - Six figures for the selected time range: total and blocked requests, tools, devices, top category and block rate.
- AI Traffic Trend - Allowed and blocked AI requests over time.
- Category Distribution - The share of AI requests in each AI category.
- Discovered AI Tool Catalog - Every AI tool with traffic, with its request count and status.
- Top AI Devices - Devices ranked by AI request volume.
- Recent AI Blocks - Recent blocked AI requests.
- Top AI Networks - Networks ranked by AI request volume.
- Top AI Mobile Agents - Mobile devices ranked by AI request volume.
At the top right, 'Export CSV' exports the data and 'New AI Policy' starts a wizard that adds AI categories to a category rule. Possible time ranges are Last 1 Hour, Last 24 Hours and Last 7 Days. MSP customers can view the Shadow AI statistics of a particular customer.

Blocking is done through policies, as explained in 'Block AI Tools'.

