When a regulator or insurer asks what your employees put into AI, "we don't know" is the wrong answer.
The data has been leaking for years. The audit trail to prove you governed it arrives now.
Do you block or do you govern? Both, in order: Discover, Detect, Defend. We don't just block, we show our work, and the work is the evidence a regulator or insurer asks for. Document shadow AI risk and keep a queryable audit trail for ISO 27001, HIPAA, PCI DSS, SOC 2, FISMA, and the NIST AI RMF. See how we handle the data behind that evidence.
Download the Compliance Mapping Guide
Frameworks covered
Find your framework
Jump straight to the controls we map for yours.
Audit readiness
When the auditor asks about AI governance, you'll have the answer
Regulators, insurers, and boards are already asking these questions. The question isn't whether you'll be asked. It's whether you'll have evidence.
"Which AI tools are employees using?"
Shadow Defend auto-discovers every AI tool across your managed browsers, including tools not on any approved list.
"Is sensitive data being shared with AI?"
Every prompt is inspected for PII, credentials, source code, and regulated data before it reaches the AI provider.
"Can you see AI use that happens on personal accounts?"
Yes. Shadow Defend inspects prompts at the browser layer, so it catches AI interactions even when employees are logged into personal accounts on unapproved tools. That's the usage network and API-based tools can't see.
"What governance controls are in place?"
Adaptive policy enforcement: audit, warn, or block based on tool, account coverage, data sensitivity, and user role.
"Can you produce evidence of AI governance?"
A queryable audit trail logs every AI interaction with timestamps, users, tool, action taken, and auto-redacted sensitive patterns.
"How quickly can you detect a policy violation?"
Real-time. Violations trigger instant alerts to Slack, email, webhooks, or your SIEM. No batch processing or next-day reports.
Cyber Insurance
The Questions Underwriters Now Ask About AI
Insurers are adding AI-governance questions to applications, and most policies weren't written with AI in mind. Shadow Defend gives you the evidence to answer them.
Sources: IBM Cost of a Data Breach 2025; Aon AI Fact Sheet 2026; Aon/Ponemon 2026; Areebi Index Q2 2026.
| Underwriting question | How Shadow Defend answers it | Coverage |
|---|---|---|
| Do you maintain an inventory of AI tools in use? | Yes. Automatic discovery of any browser-based AI tool, including ones not on any list. | Yes |
| Can you show what sensitive data has been shared with AI? | Yes. A queryable audit trail with PII, secrets, and API keys auto-redacted. | Yes |
| How do you enforce an AI acceptable-use policy? | Partial. We enforce warn/block/log per policy, but your team authors the rules. We provide the evidence that enforcement happened. | Partial |
| Do you govern AI use inside approved SaaS apps? | Partial. At the browser layer, DOM/iframe detection covers any web SaaS app your team uses in a managed browser. | Partial |
| What is your data-retention posture for AI interactions? | Yes. Configurable 7 / 90 / 365 days by tier, exportable for underwriter review. | Yes |
| Can you detect AI-impersonation and AI-phishing risk? | Yes. The AI Presence Indicator warns before an employee trusts an AI on an unknown site, and the event is logged. | Yes |
| How quickly can you produce evidence after an incident? | Yes. Export filtered audit evidence on demand, not by re-running reports. | Yes |
Regulatory hooks
- HIPAA: Security Rule audit controls (§164.312(b)) and the HHS-proposed AI-inventory requirement map to our audit trail and automatic discovery.
- GLBA: safeguarding rules for customer financial data already prohibit leaking it into unapproved AI; our monitoring and redaction logs support the required oversight.
- SEC 8-K: material cybersecurity incident disclosure (effective late 2025); AI-driven incidents qualify, and our audit evidence supports the disclosure.
- GDPR Art. 32: ongoing review of data security; our monitoring and redaction logs provide the evidence for it.
- EU AI Act: Article 50 transparency obligations took effect August 2, 2026; standalone high-risk obligations were deferred to December 2, 2027 under the Digital Omnibus. The fine ceiling is 7% of global annual turnover. We export the evidence; we do not auto-generate framework-mapped compliance reports.
- EN 18286:2026: the first harmonized EU AI Act standard, cited in the Official Journal in October 2026. It maps to the Article 17 quality management system for providers of high-risk AI systems; most organizations we serve are deployers rather than providers, and deployer-side AI-use governance is where our audit evidence applies.
- NIST AI RMF: GOVERN 1.6 calls for a mechanism to inventory AI systems, MEASURE 3.1 for tracking existing and emergent risks, and MANAGE 4.1 for post-deployment monitoring. Our discovery, alerting, and audit trail supply all three at the usage layer; 60%+ of US enterprise AI policy filings already cite the framework.
ISO 27001
Information Security Management
ISO 27001 is the international standard for information security management systems (ISMS). It provides a framework for managing sensitive information through risk assessment and continuous improvement.
How Shadow Defend Helps: Shadow Defend helps organizations meet ISO 27001 requirements by maintaining an inventory of AI tools accessed via browser, monitoring their usage, and generating audit trails for information security controls.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| A.5.23 | Information security for cloud services | Detects unsanctioned AI tools and tracks sanctioned AI usage accessed via web browsers | Partial |
| A.8.8 | Management of technical vulnerabilities | Identifies Shadow AI tools with potential security vulnerabilities and data exfiltration risks | Partial |
| A.8.15 | Logging | Maintains audit trails of browser-based AI interactions for security event analysis | Partial |
| A.8.16 | Monitoring activities | Real-time monitoring of AI tool usage in browsers with anomaly detection | Partial |
| A.8.32 | Change management | Automatically detects new AI tools entering the organization via browser access, supporting change control processes | Partial |
ISO 27701
Privacy Information Management
ISO 27701 extends ISO 27001 to establish a Privacy Information Management System (PIMS). It provides requirements for organizations acting as PII controllers or processors.
How Shadow Defend Helps: Shadow Defend supports privacy compliance by identifying what PII is being processed by AI tools in browsers and maintaining audit logs that serve as evidence of AI-related data processing.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| 7.2.1 | Identify lawful basis for processing | Shows what personal data is being processed by AI tools, supporting lawful basis documentation | Supporting |
| 7.3.2 | Processing records | Audit logs serve as evidence of browser-based AI data processing activities | Partial |
| 7.5.1 | Privacy impact assessments | Detection data feeds privacy impact assessments for AI tool usage | Partial |
ISO 42001
AI Management System
ISO 42001:2023 is the international standard for AI management systems. It specifies requirements for establishing, implementing, and improving AI governance within organizations.
How Shadow Defend Helps: Shadow Defend addresses ISO 42001 requirements for AI system monitoring, risk assessment, and impact documentation within browser-based contexts, which is the core of AI governance for web-accessed tools.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| 6.1.2 | AI risk assessment | Risk scoring and classification of AI tools accessed via browser aligns with AI-specific risk evaluation requirements | Partial |
| 8.2.1 | AI impact assessment | Monitoring data provides evidence for AI system impact documentation | Partial |
| 9.1.2 | Monitoring AI systems | Core purpose: monitors AI system usage in browsers with anomaly detection | Partial |
| A.6.3 | AI system deployment | Detects and tracks AI tools deployed or accessed via browser | Partial |
ISO 27017
Cloud Security
ISO 27017 provides cloud-specific security controls extending ISO 27002. It clarifies responsibilities between cloud service providers and customers for protecting data.
How Shadow Defend Helps: Shadow Defend monitors AI cloud service usage in browsers and maintains visibility into which cloud AI services process company and customer data.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| CLD.6.3.1 | Shared roles & responsibilities | Documents which AI services process company/customer data, clarifying responsibility boundaries | Supporting |
| CLD.12.4.5 | Monitoring of cloud services | Monitors AI cloud service usage and data flows in browsers for security visibility | Partial |
ISO/IEC 27090
AI Security Threats
ISO/IEC 27090:2026 provides guidance, not auditable requirements, for organizations that develop or use AI systems on understanding, detecting, and mitigating AI-specific security threats such as data poisoning, evasion, prompt and output injection, model theft, and inference attacks. It builds on ISO 27001/27002 and complements ISO 42001.
How Shadow Defend Helps: ISO/IEC 27090 addresses attacks against AI systems, so most of its mitigations belong to the organizations that build those systems. Shadow Defend contributes where organizations use third-party AI via the browser: it maintains the inventory of AI systems and their use that Clause 5.2 calls for, screens model inputs for sensitive data before they leave the organization, and supplies the logging, monitoring, and alerting mitigations Clause 7 recommends.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| 5.2 | Inventory of AI systems and their use | Auto-discovers and maintains the inventory of AI systems and their use that Clause 5.2 calls for, covering browser-accessed tools | Full |
| 5.2 | AI governance programme | Tool risk scoring, usage monitoring, and audit evidence feed the risk analysis and monitoring parts of the AI governance program; the rest of the program remains with the organization | Supporting |
| 5.5 | Supply chain management | Inventories and monitors third-party AI services accessed via browser, supporting AI supply-chain threat visibility | Supporting |
| Clause 6 | Types of potential compromise to AI systems | Most compromises in this clause are mitigated within the AI system itself; at the usage boundary, prompt inspection detects confidential data disclosed through model inputs | Supporting |
| Clause 7 | Mitigations: logging, monitoring, input detection | Real-time monitoring, anomaly alerting, and exportable interaction logs provide the logging and monitoring mitigations; prompt inspection adds input screening at the usage layer | Partial |
HIPAA
Health Insurance Portability and Accountability Act
HIPAA establishes national standards for protecting sensitive patient health information. The Security Rule requires administrative, physical, and technical safeguards for ePHI.
How Shadow Defend Helps: Shadow Defend helps healthcare organizations maintain HIPAA compliance by detecting PHI transmitted to unsanctioned AI tools via browser and maintaining audit trails for compliance evidence.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| § 164.312(b) | Audit controls | Maintains logs of browser-based AI interactions involving PHI | Partial |
| § 164.312(d) | Access controls | Identifies sanctioned vs. unsanctioned AI tool usage to inform access policy enforcement | Supporting |
| § 164.312(e)(1) | Transmission security | Detects PHI transmitted to unsanctioned AI services via browser | Partial |
| HHS Proposed (2025) | AI inventory requirement | Maintains inventory of AI tools accessed via browser that may touch PHI | Partial |
SOC 2
Service Organization Control 2
SOC 2 is a compliance framework for service organizations based on Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
How Shadow Defend Helps: Shadow Defend addresses SOC 2 criteria by providing visibility into browser-based AI tool usage, maintaining audit trails, and detecting potential data disclosure to third-party AI services.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| CC6.1 | Logical access controls | Tracks browser-based AI tool access and associated data flows | Partial |
| CC7.1 | System operations monitoring | Real-time monitoring of AI data transmissions in browsers | Partial |
| CC9.2 | Vendor monitoring | Maintains inventory of AI vendors with risk assessments | Partial |
| CC6.7 | Data transmission | Monitors data sent to AI providers in browsers, identifies sensitive data exfiltration | Partial |
| CC6.8 | Unauthorized disclosure | Detects confidential data sharing with unsanctioned AI tools in browsers | Partial |
PCI DSS
Payment Card Industry Data Security Standard
PCI DSS is the security standard for organizations handling credit card data. It establishes requirements for protecting cardholder information throughout the data lifecycle.
How Shadow Defend Helps: Shadow Defend helps organizations maintain PCI DSS compliance by monitoring AI tool usage in browsers within cardholder data environments and maintaining service provider inventories.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| 7.2 | Least privilege access | Identifies AI tools with excessive data access, supporting access control reviews | Supporting |
| 8.2-8.6 | User authentication | Logs AI service account usage in browsers, detects unauthorized accounts | Supporting |
| 12.8.1 | Service provider inventory | Maintains inventory of AI service providers accessed via browser | Partial |
CIS Controls
Center for Internet Security Controls
CIS Controls are prioritized cybersecurity best practices. They provide actionable guidance for defending against common cyber attacks through technical controls.
How Shadow Defend Helps: Shadow Defend addresses CIS Controls for asset and software inventory (the foundation of security programs) by discovering and cataloging AI tools accessed via browser.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| 1.1 | Establish asset inventory | Discovers and catalogs AI tools accessed via browser across the organization | Partial |
| 2.1 | Establish software inventory | Maintains inventory of AI applications and browser extensions | Full |
| 2.3 | Unauthorized software | Detects and alerts on unsanctioned AI tools accessed via browser | Partial |
FISMA/NIST
Federal Information Security Modernization Act
FISMA requires federal agencies to implement the NIST Risk Management Framework. NIST SP 800-53 provides security and privacy controls for federal systems, now with AI-specific overlays.
How Shadow Defend Helps: Shadow Defend addresses FISMA continuous monitoring requirements and supports NIST SP 800-53 AI system overlays for automated monitoring and risk assessment of browser-accessed AI tools.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| SI-04(02) | System monitoring - automated analysis | Real-time monitoring of browser-based AI tool usage with anomaly detection | Partial |
| CA-07 | Continuous monitoring | Ongoing monitoring of AI-related risks and controls for browser-accessed tools | Partial |
NIST AI RMF
Artificial Intelligence Risk Management Framework 1.0
The NIST AI Risk Management Framework (NIST AI 100-1, January 2023) is the voluntary, outcome-based framework for managing AI risks, organized into four functions: GOVERN, MAP, MEASURE, and MANAGE. It is widely referenced in enterprise AI policies, federal guidance, and insurer underwriting questions.
How Shadow Defend Helps: Shadow Defend supports AI RMF outcomes at the usage layer, where employees interact with external AI systems: it builds the AI system inventory GOVERN 1.6 calls for, provides continuous actual-usage monitoring and emergent-risk tracking (MEASURE 3.1), privacy-risk visibility (MEASURE 2.10), and the policy actions, alerts, and audit evidence MANAGE expects. It does not perform testing, evaluation, verification, and validation (TEVV) of AI models themselves; that remains with the organizations that own those systems.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| GOVERN 1.6 | Inventory AI systems | Automatically discovers and maintains an inventory of AI tools accessed via browser, including tools absent from approved lists | Full |
| GOVERN 4.2 | Document risks and potential impacts of AI technology in use | Monitoring data and audit trails document which browser tools employees use and what data reached them | Supporting |
| GOVERN 4.3 | Incident identification and information sharing | Real-time alerts and shareable audit evidence support incident identification and information sharing | Supporting |
| GOVERN 6.1 | Third-party AI risk policies | Inventory and monitoring data support policies addressing AI risks from third-party entities | Supporting |
| GOVERN 6.2 | Contingency for high-risk third-party incidents | Instant alerting and browser-layer controls support responses to incidents or failures in high-risk third-party AI systems | Supporting |
| MAP 4.1 | Map risks for all AI system components, including third-party software | Discovers browser-accessed third-party AI tools, feeding the risk mapping of third-party components | Supporting |
| MAP 4.2 | Identify and document internal risk controls | Warn/block policy actions and audit trails document usage-layer risk controls for third-party AI tools | Supporting |
| MEASURE 3.1 | Track existing and emergent AI risks over time | Real-time monitoring and alerting track actual AI tool usage in deployed contexts, including personal accounts and newly adopted tools | Partial |
| MEASURE 2.10 | Privacy risk of AI systems examined and documented | Inspects prompts for PII, credentials, and secrets before they reach AI providers; audit logs document resulting exposure | Partial |
| MANAGE 4.1 | Post-deployment monitoring, incident response, and override | Policy-based warn/block actions, instant alerts to Slack, email, webhooks, or SIEM, and exportable audit evidence support post-deployment monitoring | Partial |
| MANAGE 3.1 | Third-party AI risks and benefits regularly monitored | Continuously monitors third-party AI tool usage reached via browser and applies and documents browser-layer risk controls | Partial |
IEEE 2863
Organizational Governance of AI
IEEE 2863-2026 is a voluntary recommended practice for organizational governance of AI. It describes governance principles an organization's governing body should apply, processes for putting them into practice (life-cycle oversight, auditing, incident response, value chain management), and case studies. It targets organizations that develop or use AI and does not prescribe technical requirements for AI systems.
How Shadow Defend Helps: IEEE 2863 frames AI governance as an activity of the governing body, covering organizations that use AI as much as those that build it. Shadow Defend gives the governing body its operating picture: what AI tools are in use, how they are being used, enforcement of usage policy through warn and block actions, and audit evidence that governance decisions were carried out.
| Control | Requirement | Shadow Defend Coverage | Alignment |
|---|---|---|---|
| Principles | Security, accountability, and human oversight of AI use | Usage monitoring and per-interaction audit evidence give the governing body oversight of the AI tools employees actually use | Supporting |
| Processes | Life-cycle oversight, auditing, and incident response | Continuous monitoring, real-time alerts, and exportable audit trails support AI-use oversight and post-incident evidence | Partial |
| Processes | Value chain management | Inventories and monitors third-party AI services accessed via browser, including accounts and data flows | Supporting |
Get the audit trail before the regulator asks for it.
Only 37% of organizations have an AI governance policy (IBM 2025). Be one of them.