New Capability: Shadow AI Remediation (SAIR)

Announcements Product News
, ,
1

:sparkles: Description

Shadow AI Remediation (SAIR) gives organizations real-time visibility and control over how AI tools are actually used by employees, reducing security, privacy, and compliance risks associated with shadow AI. By combining discovery with just-in-time remediation and guided workflows, it enables safe AI adoption without slowing down productivity.

:red_exclamation_mark: Problem

Organizations today have little to no visibility into how employees are adopting AI tools across browsers, SaaS apps, extensions, and identity ecosystems. This creates unmanaged “shadow AI” usage that introduces security, privacy, compliance, and data-exposure risks, while leaving IT and security teams without effective ways to guide or control adoption in real time.

:light_bulb: Solution

Shadow AI Remediation

SAIR (Shadow AI Remediation) is a solution designed to discover and remediate the use of shadow AI tools across an organization. It provides identity security, IT, and risk teams with full visibility into the rapidly expanding landscape of shadow AI” where employees adopt external AI services without centralized oversight.

Core Capability

SAIR builds a comprehensive, continuously updated inventory of AI tools in use by correlating signals from identity providers, browser activity, and application API.

Discovery Coverage

The platform identifies AI usage across multiple vectors:

  • Browser-based usage: detection of AI tools accessed through web applications and real user activity
  • Identity provider (IdP) integrations: visibility into AI applications connected via SSO and enterprise identity ecosystems
  • Browser plugins: identification of AI-powered browser plugins, including extensions that operate as AI agents

This enables organizations to map the full spectrum of AI adoption, including:

  • Text generation and prompt-based tools
  • Marketing and content automation platforms
  • Note-taking and productivity AI applications
  • Sales and customer engagement AI tools
  • AI agent frameworks and automation extensions

Technology Approach

SAIR delivers this visibility through a layered architecture:

  • IdP connectors that surface identity-driven access and application adoption
  • A browser plugin, deployed seamlessly across endpoints, that detects real usage patterns, installed plugins, and interactions with AI services
  • Correlation across identity, application, and endpoint signals to create a unified AI usage inventory

Remediation & Governance

Beyond discovery, SAIR includes built-in remediation capabilities, designed to actively manage Shadow AI usage at the moment it occurs.

The platform enables:

  • Just-in-Time intervention workflows triggered when unsanctioned AI tools are detected
  • User-facing playbooks that guide employees in real time on compliant and approved usage
  • Redirection to sanctioned enterprise AI tools when users attempt to access non-approved services
  • Policy-aligned enforcement that supports education, risk reduction, and behavior change without disrupting productivity

These remediation flows operate directly in the user context, helping organizations move from passive visibility to active governance.

SAIR dashboard screenshot
SAIR dashboard screenshot1852×845 54.8 KB

image-20260218-071848
image-20260218-0718481371×777 90 KB

:busts_in_silhouette: Who is affected?

Shadow AI Remediation is now available. Please connect with your account team to learn more. (Not available in FedRAMP environments.)

:clipboard: Action required

For information on Shadow AI Remediation, please connect with your account team.

:date: Important dates

Sandbox availability: 3/9/26
Production rollout: 3/17/26

2

@kirby_fitch I’m struggling a bit here to grasp how this ties in with the overall ISC platform. Since you have rollout dates below, I’m assuming there are updates in ISC that tie to SAIR.

Does the below point mean SAIR detections will be able to trigger an ISC workflow?

  • Just-in-Time intervention workflows triggered when unsanctioned AI tools are detected

Also, what is the dashboard you provided a screenshot of? Will this be another dashboard in ISC similar to AIC, etc? or a completely different product?

3

@patrickboston If I understand correctly, this used to be Savvy technology, a solution from a different organization, which is now owned by SailPoint. I believe this is the reason why there is no immediate link to ISC itself, and why the dashboard looks different. Just like how NERM, once Seczetta, was a different solution, whose API’s are not consistent to the ISC API’s. As we see how NERM is slowly getting integrated with ISC, I expect something similar to occur with this new tool as well.

This announcement opens many new questions. Which browsers are supported, which ones only partially and which ones not at all? What about HTTP clients different to browsers such as postman/bruno, or just basic scripts running on someone’s laptop?

Can it truly prevent wrong usage of AI, or only detect it post-fact for some cases?

Regardless, since SailPoint is focussing on this solution, they automatically have less attention to spend on other areas such as the core IGA functionality. Perhaps (distracting?) side-missions like these contribute to missing core functionality such as “read only admin access”, which was and still is the most requested idea for over 5 years now, both for IIQ and for ISC.

4

@angelo_mekenkamp yep I’m aware of the acquisition. That’s why I was wondering if this is just a standalone thing or ties back in to ISC now.