Discover · AI Inventory
Guided rollout· AI BOM export in CycloneDX, JSON, and CSVDecide which AI your teams can use
Halo turns discovery signals into an AI inventory where reviewers classify each item as sanctioned, monitored, blocked, shadow, or unknown, then export an AI bill of materials in CycloneDX, JSON, or CSV.
At a glance
- classifications for each AI item
- 5
- AI BOM export formats
- 3
- supported BOM format
- CycloneDX
Why it matters
A list of AI tools goes stale fast
Teams add AI tools faster than a spreadsheet can track, and security reviews, procurement, and customer questionnaires keep asking which AI is in use. Without an inventory that updates as devices report, the honest answer is a guess.
- 01
Auditors and customers ask for a current list of AI systems, and a stale spreadsheet cannot answer.
- 02
Unreviewed tools pile up when nobody owns the review queue.
- 03
Risk decisions need context such as where a tool was seen and when it was last active.
AI bill of materials
An AI BOM your reviewers can export
The AI BOM lists the AI applications Halo has found, with classification, source, and risk context. Export it as CycloneDX for tooling that reads that format, JSON for custom processing, or CSV for spreadsheets and stakeholder reports.
- CycloneDX for supply chain tooling
- JSON for custom processing and SIEM ingestion
- CSV for spreadsheets and stakeholder reports
- Exports follow your current filters
Capabilities
Review, classify, and export in one place
The inventory fills in as browsers and devices report, and each item carries the context a reviewer needs to make a call.
- Five clear classifications
- Mark items sanctioned, monitored, blocked, shadow, or unknown so security, IT, and governance teams share one vocabulary for AI decisions.
- Source and confidence
- Findings record where Halo saw them and how confident the match is, so reviewers can check the evidence before they classify.
- Filters for triage
- Filter by status, risk level, surface, and category to focus on unreviewed apps with the highest data exposure first.
- Risk level as a guide
- A risk level helps reviewers decide which unreviewed apps to examine first. It informs the review and does not change an item's status on its own.
- Where each app was seen
- Open an item to see which browsers and devices reported it and when, so you can judge who is affected before you change a status.
- AI BOM export
- Export the inventory as a CycloneDX, JSON, or CSV AI bill of materials for audits, procurement reviews, and security questionnaires.
How it works
From signal to exported AI BOM
Halo adds items as browsers and devices report them, so reviewers spend their time on decisions.
- 1
Collect signals
Halo Browser and Halo Endpoint report AI sites, extensions, applications, runtimes, and configuration signals from enrolled browsers and devices.
- 2
Match and enrich
Halo matches each signal to its AI catalog and attaches the source, a confidence level, and a risk level that helps reviewers prioritize.
- 3
Classify
Reviewers set a status for each item. New and unreviewed items stay visible as shadow or unknown until someone decides.
- 4
Export and apply
Export the AI BOM with your current filters, and let policy reference classifications, including Halo Browser controls that audit, warn, or block.
FAQ
Questions, answered
An AI bill of materials lists the AI components an organization uses, much like a software bill of materials lists software components. Halo exports its inventory as an AI BOM in CycloneDX, JSON, or CSV, so security, procurement, and audit teams can work with it.
Halo Browser and Halo Endpoint report what they observe, and Halo adds items to the inventory automatically. You do not enter apps by hand. New items stay visible as shadow or unknown until a reviewer classifies them.
Sanctioned means approved for use. Monitored means permitted with logging while it is under review. Blocked means not permitted. Shadow means detected and not yet reviewed. Unknown means Halo has too little data to classify the item yet.
The inventory reflects what enrolled browsers and devices have reported, and each item shows when it was last active. Items from browsers or devices that are not enrolled or not reporting do not appear, so enrollment coverage sets the limits of the picture.
Policy can reference inventory classifications, and Halo Browser controls support audit, warn, and block modes. A practical approach is to observe first, then move specific classifications to stricter modes after a reviewer confirms the matches.
Put a halo around the AI your business runs.
See discovery, runtime policy, approvals, and evidence working together on your own use cases.