Ce site existe aussi en français.Lire en français
Este sitio también está disponible en español.Leer en español
Este site também está disponível em português.Ler em português
Shadow AI detection for security teams
A browser extension and a lightweight Windows or Linux agent show which AI services each workstation uses, and mask sensitive data in the prompt before it is sent. Self-hosted, with no proxy and no TLS interception.
Why now
Your teams are pasting customer files, contracts and source code into AI assistants to work faster. Nobody is at fault. But nobody can answer those three questions either.
of organisations studied said they suffered a breach involving shadow AI.
added to the average breach cost where shadow AI levels were high, compared with low levels or none.
of breached organisations had no AI governance policy or were still developing one.
Source: IBM, Cost of a Data Breach Report 2025 (PDF), pp. 6–7. Figures quoted as published; Milvago has no commercial relationship with IBM.
What Milvago does
A browser extension and a small workstation agent observe supported AI services in the browser. Community recognises ChatGPT and Claude; Enterprise adds the rest of the service catalogue, installed-tools inventory and native applications: Claude Code, Codex and Claude Desktop.
A usage map connects people, tools, services and models as weighted flows, with sensitive usage highlighted. A filtered activity log, saved views and JSON, CSV and PDF exports give you what an audit needs. Unknown stays unknown: nothing is guessed.
Per organisation, per subsidiary, per workstation: observe a service, block it, mask sensitive data before it leaves the device, or flag an event for review. Rules are signed, expire, and apply even when a workstation is offline.
Why not your SSE, CASB or DLP?
| Criterion | Milvago | Network SSE, CASB or DLP (typical) |
|---|---|---|
| Where it runs | On the workstation: a browser extension and a lightweight agent | In the network path: a proxy or a cloud gateway |
| TLS interception | None | Usually required to read AI traffic |
| Remote work, off VPN | Signed rules apply on the device, even offline | Only traffic routed through the gateway is seen |
| Sensitive data | Masked in the prompt, before it is sent, on supported services | Typically blocked or flagged after inspection in transit |
| Native AI applications | Claude Code, Codex and Claude Desktop, in Enterprise | Visible as traffic only where it can be decrypted |
We compare product categories, not vendors. Milvago complements a network security stack; it does not replace it.
Try it in two minutes
Milvago's MCP server lets an AI assistant query your usage data with the rights of the person who signs in. It is read-only: no tool changes a policy, a device, a member or a setting. MCP is an Enterprise module, and you can try it on the live demo now.
https://demo.milvago.ai/mcpPrivacy by construction
A visit, a request and an installed tool are three distinct facts. By default Milvago records the fact and the names of the files sent, not the conversation itself. Capturing prompts and responses is possible, but it is off until someone authorises it. Sensitive data is detected and masked on the workstation, before anything is sent. That default is what makes the product acceptable to your works council, your DPO and your employees.
Built for regulated environments
Your data never leaves your infrastructure. On-premises or your own cloud. No telemetry to the vendor, no proxy to insert, no TLS interception and no traffic rerouted through a third party.
Local queues encrypted with keys protected by the operating system. Policies and updates signed; a tampered or expired policy is refused.
Single sign-on, MFA, per-organisation roles and permissions, plus an LDAP directory on the self-hosted editions. Every administrative action is written to an append-only audit log.
In the Enterprise edition, subsidiaries are isolated at the database level. A parent organisation never reads a child's data implicitly.
A browser event is not a software inventory, and a visit detected by hostname shows that a workstation reached a platform, not what was done there. Milvago names the limits of what a browser can and cannot capture, promises no coverage without measurement, and shows empty states instead of invented data. That honesty is part of the product.
Three editions
FreeApache-2.0 and AGPL-3.0
$5per workstation per monthMonthly or annual billing · No minimum · 30-day free trial
Coming soonJoin the waitlist to be told first
Questions CISOs ask first
Both, and the two words are worth keeping straight. Shadow AI is the symptom: AI tools adopted by teams without the organisation knowing. It is the term you will find in IBM's breach reporting, in PagerDuty's and ISACA's surveys, and it is what people actually search for.
AI usage control is the category: discovering which AI services are used, attributing usage to workstations and people, applying a policy, and reporting on it. That is the label an RFP built on analyst taxonomy will use, and it is where Milvago sits.
Milvago does the discovery that makes shadow AI visible, then the policy and reporting that turn it into control. If your procurement grid asks for one and your incident report says the other, they are the same product.
Milvago follows an open-core model. Community is open source: its agent and browser extension are Apache-2.0, its server and console AGPL-3.0. Enterprise adds the full nine-service catalogue, targeted native AI application coverage, multi-organisation governance, SIEM export and vendor support. You can audit and rebuild the Community components that run on workstations.
Not by default. Out of the box Milvago records facts about an exchange: when, which service, which workstation, what action, how large, the names of any files sent, and which sensitivity labels were detected locally. The text of prompts and responses is not sent.
Milvago can capture that text, and we would rather say so plainly than hide it in a datasheet. It is a separate option, disabled by default, that an administrator has to turn on per organisation with a dedicated right. When it is on, masking still applies on the workstation first, the text is encrypted per organisation, reading it requires MFA and a specific permission, and every read is recorded in the append-only audit log. Whether you turn it on is a decision for your DPO and your works council.
The agent runs on Windows and Linux, in every edition. The extension covers Edge, Google Chrome, Brave, Vivaldi, Firefox, Arc — Chromium-based browsers plus Firefox. macOS, mobile and personal devices are not covered today.
In the browser it recognises 9 services today: ChatGPT, Claude, Le Chat, Copilot, Gemini, Gemini Notebook, DeepSeek, Perplexity, Grok. Community recognises ChatGPT and Claude in full; Enterprise and Cloud recognise the whole catalogue. On top of that, every edition detects 160+ more AI platforms by presence — the fact that a workstation reached them, never their content. The catalogue and the allowed domains are served by your own instance, so they follow your policy rather than a release. An enabled service does not imply exhaustive coverage of its interface: coverage is documented service by service and validated by measurement. We do not claim universal coverage. See the catalogue.
Not today. The agent runs on Windows and Linux. macOS is planned, and we will not announce a date we cannot hold. Mobile and personal devices are not covered either.
On managed browsers the extension is force-installed by policy, so a user cannot remove it. The console shows a browser as active only when its extension has reported recently; otherwise it reads “Silent since” with the date, which tells a disabled extension apart from a workstation that simply does not use AI.
On Windows, the agent checks every 60 seconds that browser policies still force-install the extension, and logs an error naming the affected browsers when they no longer do.
Your console provides the Windows package: an MSI, a PowerShell script and a provisioning file. Deploy it with Intune, SCCM/ConfigMgr or GPO software installation; when one of those tools owns versions, the agent's self-update steps aside. The extension is force-installed through managed browser policy: ExtensionInstallForcelist for Chromium browsers, ExtensionSettings for Firefox. Windows workstations must be joined to Active Directory or Microsoft Entra ID. On Linux, use the RPM or the archive. See deployment.
There is no proxy and no traffic rerouting: requests go straight from the browser to the AI service. Presence detection compares the hostname of a top-level visit; sensitive-data detection runs locally, on supported services, when a prompt is sent.
We have not published benchmark figures yet, so measure it yourself: Community is free to install on a few workstations.
Shadow AI is not a future risk. It is happening in your organisation this week. Deploy Community today, or talk to us about Enterprise.