AI tool
Kimi19 people, in the browserReads what people paste into it
Find the AI outside your view.
See the AI tools, MCP servers and skills nobody mentioned, who uses them and what data they reach. Then give each one an owner and a decision.
Each one gets an owner and a decision.
AI tools in usePeopleStatus
Microsoft Copilot67Approved
ChatGPT Enterprise47ApprovedFound by Pulse, not on your list
Claude41Approved for LegalKimi19Replaced by Copilot
DeepSeek6Not allowed
Perplexity5Review by the CISOShadow AI is AI nobody decided on.
It is rarely bad intent. It is people trying to work faster. The risk is what it can reach.
Kimi19 people, in the browserMCP server
Stripe8 people, added to ChatGPTReads and changes billing records
Skill
Client letter drafts6 people, shared in ChatGPTWorks on client files
From found to decided, one tool at a time.
The answer is a decision, not a ban. Here is what happens to one of them.
KimiAI tool, in the browser- 2 SepFound
Pulse sees it on 19 laptops. Nobody mentioned it.
- 4 SepUnderstood
It reads your Slack through an MCP server. The vendor’s terms are summarised.
- 9 SepDecided
Use Copilot instead. The decision is on record.
Jordan Lee, CISO - 10 SepCarried out
Access through a company sign-in is removed in Microsoft Entra. The rest is flagged.
How Grasp finds it.
Your sign-in and the interviews. With Grasp Govern, the add-on to Grasp Work, Pulse also finds what nobody mentioned.
MCP servers in use
JiraFrom Copilot · reads and changes · 42 peopleApproved
SalesforceFrom ChatGPT · reads · 27 peopleApproved
SlackFrom Kimi · reads · 19 peopleNeeds reviewStripeFrom ChatGPT · reads and changes · 8 peopleNot approvedThe connections nobody drew.
An MCP server is a connection that lets an AI tool read or change another system. You see which AI tools reach which systems, through which MCP server, and what they may change.
Your rule
Client files never go into public AI tools.
212 of 230 people confirmed it
Exception: Perplexity, with a client fileSent to Jordan Lee, CISOTo decideYour rules, where people work.
Pulse shows your AI policy on people’s laptops and asks them to confirm it. Exceptions go to the person who decides.
Common questions
What counts as shadow AI?
Any AI tool, MCP server or skill in use that is not in your overview or not approved. Most of it is people trying to get their work done faster.
How does Grasp find it?
Through your Microsoft or Google sign-in, the interviews and, with Grasp Govern, Pulse on company laptops. Pulse finds the tools nobody mentioned.
Does Pulse see what people type?
No. Pulse sees which apps and AI tools are used, never what is in them. Your IT rolls it out and chooses when it reports.
Can Grasp block shadow AI?
Yes, for tools people sign in to with their company account: Grasp removes that access through your identity provider, such as Microsoft Entra. Other tools are flagged, and people see your rule.
Do we need Grasp Work first?
Yes. Grasp Govern is an add-on to Grasp Work. It builds on what Grasp already knows about your teams, tools and workflows from the sprint.