You cannot secure the AI tools you cannot see. Start by seeing them.
Employees adopt AI tools faster than any review process can keep up with. GhostAudit gives the security team a measured view of which tools are in use, a policy lever for each one, and an audit trail of every decision.
Example workspace. The AI usage screen, with illustrative names and figures.
| Tool | Status | People | Devices | Active hours | 12 weeks |
|---|---|---|---|---|---|
ChatGPT Enterprise OpenAI | Sanctioned | 1,284 | 1,391 | 2,912 | |
Microsoft 365 Copilot Microsoft | Sanctioned | 1,102 | 1,188 | 1,640 | |
GitHub Copilot GitHub | Sanctioned | 342 | 361 | 1,206 | |
Claude Anthropic · New this month | Under review | 211 | 226 | 388 | |
Cursor Anysphere | Unsanctioned | 64 | 66 | 301 | |
Otter.ai Otter.ai | Unsanctioned | 41 | 44 | 57 | |
DeepSeek DeepSeek · 17 blocked | Prohibited | 9 | 9 | 0.4 |
Coverage across the four places AI enters a company.
A CASB sees sanctioned SaaS. An EDR sees processes, without knowing which are AI. Neither tells you that sixty engineers started using an unapproved AI code editor last month.
GhostAudit is built for that one question and looks in the places that answer it: identity, through read-only connections to Google Workspace and Microsoft 365 that show which AI apps were granted access to work accounts and with which permissions, and through Okta; code, through AI SDKs in GitHub dependency files; browsers, through an extension for Chrome and Edge; and desktops, through an agent for macOS and Windows that sees native AI apps and connections to AI API hosts. The catalog behind it recognises 86 AI tools.
The identity connections need nothing installed, so they are where most teams start.
New tools arrive as discovery findings with evidence. You can have them posted to Slack, Microsoft Teams or a webhook.
Example workspace. Names and figures are illustrative.
- Fireflies.aiGoogle WorkspaceGranted calendar and file access by 27 peopleDismissAdd to inventory
- ClaudeBrowser extension211 people on 226 devices since 14 OctDismissAdd to inventory
- CursorDesktop agentCursor.exe, Cursor.app on 66 devicesDismissAdd to inventory
- OpenAI APIGitHubopenai 1.51 in payments-service/requirements.txtDismissAdd to inventory
- Otter.aiOktaSSO app assigned to 41 peopleDismissAdd to inventory
A status per tool, applied at the browser.
Each tool has one of four statuses: sanctioned, under review, unsanctioned or prohibited. The status is a governance decision recorded in the inventory, and it is also a policy the sensors apply.
With warnings on, opening an unsanctioned tool shows your guidance first, with a button that opens the approved alternative you chose. With blocking on, prohibited tools do not load in managed browsers. Both are off by default, because most teams want to measure before they enforce.
Enforcement is deliberately light. GhostAudit steers people toward the approved tool and counts what happened: how many switched, how many continued anyway. Those numbers show whether your approved tool is a good enough substitute.
An optional sensitive-data warning adds one more prompt at the right moment. When someone pastes text into an AI tool, the extension checks it on the device for patterns such as card numbers, private keys and API tokens, and warns or stops the paste. GhostAudit receives the category and a count, never the text. It is not a DLP product: it does not inspect traffic, it does not see what is typed, and it will miss data it has no pattern for.
- Nudges with an approved alternative, per tool or per category
- Sensitive-data warnings: off by default; warn or block; seven categories
- One alert per category per day to Slack, Teams or a webhook
Example workspace. Names and figures are illustrative.
Gemini isn’t covered by our data processing agreement. ChatGPT Enterprise is, and your work account already has a seat.
Your choice is counted (switched, continued or closed). The address you were visiting is never stored or sent.
- Payment card number
- US Social Security number
- IBAN
- Email and password pair
- Private key
- API key or token
- Bulk personal data
Sensors report the category and a count. The pasted text never leaves the browser tab.
Which AI agents are wired to your systems.
The newer exposure is not a chatbot. It is a coding assistant that a developer has connected to the file system, the source repositories or a production database through an MCP server, using their own credentials.
That wiring lives in configuration files on the laptop and shows up in no network or sign-on log. The desktop agent lists the AI agent clients configured on each machine and the MCP servers they point at, reported by name, package name or hostname. It never reports the tokens, arguments or paths those files contain. Well-known servers carry a note on what they can reach, and you record which are approved.
It is an inventory, not enforcement: nothing is blocked or removed on the device. AI agent discovery lists exactly what is read.
Example workspace. Figures are illustrative.
- @modelcontextprotocol/server-filesystemstdio · npxReads and writes files in the folders it is pointed at on the device.Configured as “filesystem” in Claude Desktop, Cursor · 23 devicesHigh reachTo review
- @modelcontextprotocol/server-postgresstdio · npxEvery table the database user can query, which may include customer or personal data.Configured as “prod-db” in Cursor · 4 devicesHigh reachNot approved
- api.githubcopilot.comhttpSource code, issues and pull requests in every repository the token can access; can push changes.Configured as “github” in VS Code, Claude Code · 41 devicesHigh reachApproved
- mcp.linear.apphttpIssues and projects in the connected workspace.Configured as “linear” in Claude Code, Cursor · 17 devicesMedium reachApproved
- acme-internal-toolsstdio · nodeNot recognised. Review what it connects to.Configured as “acme-internal-tools” in Cursor · 2 devicesUnrecognisedTo review
Sensors your own team can audit in an afternoon.
You will be asked to deploy software to every endpoint, so the sensors are built to be reviewed.
The extension is about 2,300 lines of plain JavaScript with no bundler, no minification and no third-party code. By default it injects nothing into any page. Since version 1.1 it holds host access to the AI tool sites in the catalog, and to no other site, so that its one content script can be registered there while sensitive-data warnings are on; that script is about 200 lines and listens for paste, drop and file selection only. The agent is a single static Go binary with one dependency beyond the standard library, golang.org/x/sys. It opens no listening ports, executes no commands from the server, does not self-update, and needs no macOS privacy permissions. Its installers are not yet code-signed.
Both speak one documented protocol over HTTPS with TLS 1.2 or later, do not follow redirects, and authenticate with a per-device credential that the server stores only as a hash. ghostaudit-agent collect --once --dry-run and inventory --dry-run print exactly what would be sent, without sending it.
- Field-level documentation of every value collected
- A stated list of known limitations for the agent
- Revoke a device or a token from the console; a revoked sensor stops
{
"type": "web_usage",
"tool_key": "claude",
"host": "claude.ai",
"window_start": "2026-11-09T10:00:00Z",
"window_end": "2026-11-09T10:05:00Z",
"active_seconds": 240,
"visits": 3,
// pseudonymous identity mode
"user": { "hash": "9f2c…e41a" }
}Single sign-on, log export, an audit log, and the option to host it yourself.
Inside GhostAudit, access is role-based with five roles, and the read-only role is enforced by the server on every write request. Every change to the inventory, a policy, an assessment or a document is written to an audit log that can be exported. Credentials for integrations such as Google Workspace, Microsoft 365, GitHub and Okta are encrypted before they are stored.
On Govern and Enterprise, people sign in through your identity provider with OpenID Connect, and you can require it for everyone but owners. SCIM 2.0 provisioning lets the identity provider create and deactivate users, and a deactivated user is signed out at once. SAML is not supported. Log export streams audit, policy, discovery and usage events to an HTTPS webhook, Splunk or Datadog, signed and de-duplicable, with no employee identified unless you opt in and run in named mode.
If usage data about your workforce should not leave your environment, run GhostAudit yourself. The server ships as a container image with a Postgres database, and sensors enroll against your server address. Self-hosted deployment is part of the Enterprise plan.
Our security page describes how the product handles data in detail, including what we do not have yet: we have not completed a SOC 2 audit.
| Role | Can |
|---|---|
| Owner | Everything, including transferring ownership |
| Admin | Manages people, integrations, sensors and settings |
| Compliance manager | Runs assessments, approves documents, manages the inventory |
| Member | Works on the systems and documents assigned to them |
| Viewer | Read-only. The server rejects every write request |
{
"id": "0b0c6a3e-9d0f-5a67-8a55-0d7a4f1c2e11",
"type": "policy.blocked",
"stream": "policy",
"time": "2026-11-10T14:03:22Z",
"schema_version": 1,
"organization": { "id": 42, "name": "Northwind Group" },
"data": {
"policy_event_id": 5531,
"action": "blocked",
"tool_key": "deepseek",
"tool_name": "DeepSeek",
"host": "chat.deepseek.com",
"process": null,
"occurred_at": "2026-11-10T14:03:22Z"
}
}Before you approve a tool, read what its vendor states about your data.
A finding is only half a decision. The other half is the vendor's terms: does this plan train on what people type, how long is it kept, can staff read it. Vendor fact cards put that beside the finding, per plan, with the vendor's sentence, the source and the date it was read. What could not be read is marked unknown, never guessed.
When something does go wrong, the incident register holds the record: what happened, what was done to contain it, and a timeline that cannot be edited afterwards.
- Filter the inventory by training stance on the plan you hold
- Researched for about forty tools; the rest list the vendor's official pages only
Real vendor statements from the shipped fact data. Choose a tool and a plan.
- Trains on customer data
- Depends on a setting
- “If you enable " Privacy Mode " in Cursor's settings: Customer Data will not be used for training by Cursor.”
- cursor.com
- Unknown for this plan
- Default retentionZero-retention optionDeletion on requestHuman review of inputs
Questions
- Is GhostAudit a DLP or CASB?
No. It does not broker traffic or send content anywhere. It tells you which AI tools are in use and by how many people, lets you set a status per tool, and can warn, nudge or block at the browser. The optional sensitive-data warning checks pasted text on the device against a set of patterns and reports only a category and a count. It complements DLP by telling you where to point it.
- Does it support our SIEM?
Log export sends events to an HTTPS webhook, a Splunk HTTP Event Collector or Datadog Logs, on Govern and Enterprise. Microsoft Sentinel is not supported directly; use the webhook with a Logic App or Azure Function in between.
- Can it block AI tools on unmanaged devices?
No. Sensors run on managed browsers and devices. For unmanaged devices, block at the network or identity layer and use discovery through Okta to see what is being accessed.
- What does the agent need to run?
Root on macOS (a LaunchDaemon) and LocalSystem or a virtual service account on Windows. The reasons for each privilege are documented, and the lower-privilege Windows option trades away foreground-time tracking.
- AI usage monitoringThe sensors in detail.
- AI agent discoveryAI agents and MCP servers on desktops.
- SecurityHow the product handles your data.
- MCP servers at workWhat they can reach and how to inventory them.
- Answering AI questions in security questionnairesWith example questions and the evidence to attach.
- Shadow AI: how to find the tools already in useA guide for security teams.
See what is in use before you decide anything.
Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.