Any AI tool, model, agent or feature in use without approval from security or IT, including AI features vendors switch on inside licensed SaaS, coding agents, MCP servers and models running locally on laptops.

Where does Cortx look for shadow AI?

On laptops through the Sentinel device agent, in cloud accounts, in Kubernetes, in network egress logs, in EDR and device inventories, and in the admin APIs of the SaaS tools you license.

Does Sentinel read prompts or files?

No. The Sentinel device agent reports metadata only, never prompts or file contents. Everything runs inside your own network.

What happens once shadow AI is found?

It lands in one register. Approved items get an owner and a policy, apps and agents are routed to approved models with spend capped, risky agents can be held, released or terminated after approval, and every decision is recorded in one audit trail.

Capability 05 · Shadow AI Detection

Bring shadow AI into one register

Every agent action is governed by a consistent enforcement pipeline. One central decision engine powers every gate, with verifiable evidence for every decision. Cortx Sentinel detects violations and brings every finding into one unified, governable register.

Schedule a Demo

Shadow AI OverviewUnsanctioned AI activity observed across your tenant in the last 7 days.

500Shadow events

8Open cases

2Unique actors observed

Name	Source	Risk	Owner	Status

Where we look

Find AI wherever it runs

Cortx reads the telemetry you already own, so there's no new scanner where you've already paid for the data.

Where it looks

LaptopsSentinel device agent on macOS, Windows and Linux

Licensed SaaSMicrosoft 365 · Google Workspace · Salesforce

Network logsZscaler · Netskope · Palo Alto

KubernetesAgents and model servers in your clusters

Cloud accountsModels you host

EDR and devicesCrowdStrike · Defender · Jamf · Intune

Cortx Sentinel

What it finds

AI features in SaaSEnabled or widened by the vendor

AI appsIncluding new services on first sighting

Coding agentsAnd the models they call

MCP serversConnectors with a route into your data

Local modelsModel servers on laptops and in clusters

Xnode Cortx Sentinel

One decision engine. Every gate.
Signed evidence you own.

Sentinel is the containment and evidence layer of Cortx. It finds the AI your company uses, decides before each act whether it's allowed, stops agents that should stop at their next step, and keeps signed evidence you can verify offline.

Where AI lives in your company

Laptops and coding assistants

Network trafficto AI services

Cloud accountsmodels you host

SaaS AI appschat, copilots

Agent platformsCortx and any framework

Tool serverswhat agents can touch

Four steps run continuously around the six places AI shows up in a company. Each step hands the next what is on its arrow. Select a step to jump to it.

01 · Discover

Sensors on laptops, the network, clusters, cloud accounts and SaaS admin logs list every AI tool, model and agent, and who uses it.

02 · Decide

Before an agent acts, one decision engine answers allow, narrow, hold for a human, or block, the same way for every framework.

03 · Contain

A stop reaches every gate the agent uses and takes effect at its next step, in under a second on the reference install.

04 · Prove

Every decision, refusals included, is signed into a ledger you own and can check offline.

Decided once, enforced everywhere

Decisions are made once in the Cortx control plane and published as a signed enforcement snapshot. Every enforcement point follows it.

Model gateway
MCP gateway
Agent runtime
Sandbox
Device agent on laptops

Sentinel installs into your own cluster, including air-gapped ones.

From finding to control

Discovery alone is a list.
This is how it becomes control.

Inventory and score

Know what's running, riskiest first

Every finding lands in one register and is ranked by risk, so review starts where exposure is highest.

Assign and migrate

Give every tool an owner and an approved path

Approved tools get a named owner and a policy. People move onto approved models and tools through Cortx, with spend capped.

Contain and prove

Stop risky agents and keep the evidence

Risky agents are held, released or terminated after an approver signs off, and every decision lands in one audit trail.

Discovery your security team
can sign off on

What Cortx collects, where it runs, and where it stops, stated up front.

Metadata only, never prompts

The Sentinel device agent reports what is running and where, never prompts or file contents. From network logs, Cortx keeps the destination and method, not the content.

Built on telemetry you own

Where you already have EDR, egress logs or an endpoint AI tool, Cortx reads that data rather than adding another agent.

Runs inside your network

Cortx and Sentinel install into your own cluster, on premises, in your cloud tenant or air-gapped.

What we don't catch

An employee on a personal phone, off the corporate network. And network logs show that AI is used, not what happens inside the session; the browser, device and gateway paths cover that.

See what's already running.

Discovery starts before anything is enforced, with a standard deployment in under a week.