AI Asset Lens — Shadow AI Discovery & Inventory

AI Asset Lens answers the first governance question: what AI exists in the enterprise, who uses it, what data it can reach, and what should happen about it. It is a multi-tenant workbench scoped to engagements — each engagement is its own tenant with isolated storage and access boundaries.

What it discovers

The discovery surfaces cover the places AI actually shows up:

• AI applications and embedded SaaS AI features
• AI models and model APIs in use
• Agents, agent frameworks, and MCP servers
• SDKs and libraries referenced in code
• Browser extensions with AI capabilities
• AI-capable cloud services

For every asset the workbench records evidence and provenance — how it was discovered, when it was last observed, and what supports the observation — plus the organizational context: business and technical owners, department, business purpose, and what categories of data the asset can access.

How it gets evidence

Import pipeline: structured CSV/JSON exports from client security tooling are ingested, normalized, and deduplicated into the workload inventory — installed-application inventories, browser-extension lists, DNS and proxy logs, Entra application records, and CycloneDX SBOMs.

Endpoint collector: aal-collector, a lightweight Go agent deployed to endpoints as a single binary for Windows, macOS, and Linux. Running per user, it scans the machine for AI agent installations — Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI, Codex — and MCP server configurations, classifies each server connection (local stdio, local HTTP, remote, or bridge), and confirms runtime state read-only. It redacts secret values (names and flags only) and fingerprints servers with salted HMAC, so secrets never leave the machine — fingerprint matches are how the platform connects a detected agent to the identity that runs it. Snapshots enroll by token and upload to the platform's device plane for correlation into the engagement inventory.

Governance workflow

Each inventoried asset moves through an explicit triage state — sanctioned, restricted, prohibited, pending review, retired, or false positive — with inherent and residual risk, applicable controls, and a review cadence. The workbench is the place where discovery becomes a defensible, reviewable governance record.

AI security testing (OWASP ASI)

Separate from discovery: the agentic security tester is an assessment capability that consumes the inventory. It runs authorized, consultant-operated adversarial campaigns against the AI agents and MCP servers already discovered, exercising them with realistic abuse techniques mapped to the OWASP Top 10 for Agentic Applications 2026 (ASI01–ASI10). Each campaign produces findings plus an evidence pack. The platform enforces safety controls: campaigns run only inside a scoped authorization window, production targets require explicit approval and rate limits, destructive-tool scenarios are skipped without that flag, and a kill switch aborts a running campaign. The tester supports assessment against OWASP ASI and NIST AI RMF — it reports findings, not compliance verdicts.

Reporting

Engagement reports summarize the inventory, risk distribution, and triage outcomes — built for a security-leadership audience.

Status

Available today in the multi-tenant workbench, in active development with consulting engagements. Capabilities described above reflect shipped functionality; the roadmap page covers what comes next.