Shadow AI discovery
Turn unknown AI use into reviewed decisions
Halo combines guided discovery in supported browsers and macOS or Windows endpoints with inventory classification and export, so teams can review how each finding surfaced and choose a follow-up.
The challenge
AI signals arrive from different places
Browser activity, developer tools, and local runtimes can reach different owners before a shared review starts.
Browser signals sit outside device reviews
AI websites and extensions can appear in Chrome, Edge, or Safari on macOS outside workflows IT expects to review.
Developer tools span managed devices
IDE plug-ins, local runtimes, and AI-related configuration on macOS and Windows need a metadata-first review path alongside browser signals.
Findings need review context
Source, confidence, and classification help reviewers decide what to investigate, monitor, or block using their own risk criteria.
How Halo solves it
Connect discovery to a review decision
The workflow starts with supported browser and device signals, then gives reviewers context for classification and follow-up.
Discover
Halo Browser
Start with supported AI websites, browser extensions, and account posture signals in Chrome, Edge, and Safari on macOS. These browser findings join device signals in one review.
Discover
Halo Endpoint
Add metadata-first findings from macOS and Windows, including AI apps, IDE plug-ins, developer tools, and local runtimes. The device records extend the browser view with on-device context.
Discover
AI Discovery
Match supported browser and device signals into inventory records with source and confidence. Reviewers can use that context to decide how to classify a finding.
Discover
AI Inventory and AI BOM
Classify findings as sanctioned, monitored, blocked, shadow, or unknown, then export an AI BOM in CycloneDX, JSON, or CSV. The resulting inventory gives the dashboard a defined review scope.
Govern
Governance Dashboard
Bring classifications into inventory views and review audit statistics in one place. Use that view to decide which findings need follow-up in the team’s existing process.
Who's involved
Give each team a clear part in discovery
The pilot works best when rollout owners, reviewers, and governance leads agree on scope and follow-up.
IT and platform teams
Often starts here
Choose enrolled macOS and Windows device scope, coordinate supported browser extension rollout, and organize collection review with guidance from the Halo team.
Security leaders
Set investigation criteria, review findings with source and confidence, and decide which entries need a policy or incident follow-up.
Governance, risk, and compliance
Set classification guidance for sanctioned, monitored, blocked, shadow, and unknown records, then use inventory exports in the organization’s review process.
Suggested pilot
Suggested discovery pilot
This is a suggested plan, and timing depends on your environment. Browser and endpoint discovery rollout is guided by the Halo team.
- Week 1
Agree on scope and review owners
Set the browser and device scope, select participating teams, and agree on review criteria. At the end of the week, teams can show the agreed collection scope, owners, and questions for review.
- Weeks 2 and 3
Set up guided browser and endpoint discovery
With Halo team guidance, configure Halo Browser for Chrome and Edge, plus Safari on macOS, and Halo Endpoint for macOS and Windows. At the end, teams can show which browsers and devices are in scope and what enrollment remains.
- Week 4
Review signals and classifications
Set up an inventory review using source and confidence, then agree on classification and follow-up. At the end, teams can show a sample of findings with the review decision recorded in their process.
- Week 5
Export a scoped inventory snapshot
Set up the export workflow and generate an AI BOM in CycloneDX, JSON, or CSV. At the end, teams can show the exported snapshot with its scope, review date, and open questions.
Outcomes
What you can show after the pilot
Documented collection scope
Show which supported browsers and endpoints were included in the guided pilot and where enrollment remains open.
Findings with review context
Show classification, source, and confidence for sampled records alongside the follow-up decision made by the review team.
A portable inventory snapshot
Share an AI BOM in CycloneDX, JSON, or CSV for the pilot scope, with its date and stated coverage.
FAQ
Questions, answered
Halo Browser supports Chrome and Edge, plus Safari on macOS, for supported AI websites, browser extensions, and account posture signals. Halo Endpoint supports macOS and Windows with metadata-first discovery of supported AI apps, developer tools, local runtimes, and related evidence.
Halo Endpoint collects metadata such as app and configuration details, paths, hashes, and permissions on supported macOS and Windows devices. Standard collection excludes prompts, responses, documents, clipboard content, and credentials.
Content inspection in Halo Browser is off in the standard configuration. It requires expanded permissions that the customer approves, and browser discovery is limited to supported sites and signals.
The AI inventory supports sanctioned, monitored, blocked, shadow, and unknown classifications. Each record can include source and confidence so reviewers can consider how the finding surfaced.
Halo exports AI BOM data in CycloneDX, JSON, and CSV. The export is a portable inventory snapshot for review within the organization’s own process.
Plan your shadow AI discovery pilot
Bring one real use case to a walkthrough. We will map what you need to see, the decisions you need to make, and the evidence your team will review.