iboss AI Security Platform Review: Free Shadow AI Visibility

Free tier (discovery and visibility):

• Tracks prompts, sessions, users, and risk in real time across ChatGPT, Microsoft Copilot, Gemini, Claude, Perplexity, and dozens of other services
• Covers both browser-based tools and desktop AI applications such as Cursor
• Automatically inventories every AI tool the moment it appears on an endpoint
• Classifies each tool by risk level
• Attributes usage to individual users
• Provides full prompt and response history searchable by user, vendor, message, or date

Paid tiers (enforcement):

• Per-AI-category policies (allow, block, or redirect) with service-specific exceptions
• In-the-moment coaching messages that appear to users when they violate policy
• Controls over copy, paste, upload, and download actions per AI service
• Tenant restrictions to keep employees within company-managed AI accounts
• Default-deny connection policies for AI agents running on endpoints and servers
• Domain allow-lists and block-lists for AI agent outbound connections
• Data Loss Prevention (DLP) covering content sent to AI services
• Mass deployment via MDM (Windows and macOS) without individual device enrolment

Regulatory alignment.

iboss meets HIPAA, PCI, and FedRAMP standards, which are US-centric certifications. For APAC regulated industries, this translates well into Singapore's Cybersecurity Act requirements, Australia's Essential Eight framework, and general enterprise SOC2 expectations. Buyers should confirm specific data residency options with iboss for jurisdiction-specific compliance, particularly for Australia's evolving AI transparency requirements and Vietnam's AI Law.

Multi-country workforce coverage.

If your organization operates across Singapore, India, Malaysia, and Indonesia, the platform maps AI usage across your entire distributed workforce in a single pane of glass. This matters for regional HQs trying to enforce consistent AI governance without country-by-country tooling.

Shadow AI baseline.

Every APAC enterprise our advisory practice has assessed in the last 6 months has significant unmanaged AI usage. Employees running ChatGPT on personal accounts. Marketing teams using AI tools no one in security has vetted. Developers running Cursor on production code. The free tier of iboss is the fastest way to get a factual baseline before making any AI governance decisions.

Does not fix data residency or sovereignty by itself.

The platform gives visibility and control over AI usage. It does not automatically comply with jurisdiction-specific data localization requirements. If employees are sending sensitive information to US-hosted or China-hosted models, iboss will show you that, but you still need to decide what is allowed per jurisdiction.

Visibility depends on integration with your network and endpoint stack.

SMEs with highly fragmented IT, heavy mobile-only workforces, or extensive BYOD may need additional configuration to achieve full coverage.

Flags usage and risk. Does not build your policy.

The platform tells you what is happening. You still have to build your organization's own allowed-tools list, escalation workflow, and disciplinary framework. iboss provides the enforcement engine once you have the policy.

US-first product roadmap.

Feature velocity and compliance certifications lean toward US regulations (HIPAA, FedRAMP). APAC-specific overlays (Vietnam AI Law compliance modules, Australia AI transparency reporting) are not yet built-in.

Existing SASE and CASB platforms (Zscaler, Netskope, Palo Alto Networks Prisma).

If you already have one of these deployed, check whether AI usage visibility is included or requires an additional module. Many are adding AI-specific capabilities in 2026.

Standalone AI governance tools (Nightfall AI, Prompt Security, Wald.ai).

Some focus specifically on the AI usage problem without the broader SASE stack. May be simpler if you do not need the network security consolidation iboss provides.

Endpoint DLP with AI extensions (Digital Guardian, Forcepoint DLP).

Cover AI as one data flow among many. Better if data loss prevention is your primary problem and AI is one channel; less useful if AI-specific visibility is what you need.

Is the free tier really free forever?

Yes. iboss's public positioning is that discovery and visibility are free with no time limit. Paid tiers add enforcement capabilities. iboss made discovery free to establish an industry baseline for AI security.

Does iboss capture actual prompt content?

The platform captures prompts, responses, and session data with full search capability. Whether this data is stored, how long it is retained, and where it is stored depends on your configuration and jurisdiction. Review the platform's data handling documentation before deployment for sensitive environments.

Can I deploy iboss across a mixed Windows and macOS workforce?

Yes. Mass deployment is supported via existing MDM solutions for both Windows and macOS. Pre-configured installers can be distributed across large fleets without individual device enrolment.

Does iboss cover AI agents running on servers, not just user devices?

Yes. The platform includes default-deny connection policies for AI agents running on endpoints and servers, with domain allow-lists and block-lists. This addresses the growing risk of autonomous AI agents making outbound connections security teams cannot detect.

What is the difference between the AI Security Platform and the broader iboss Zero Trust SASE platform?

The AI Security Platform is delivered on the same iboss Zero Trust SASE cloud infrastructure but focuses specifically on AI usage visibility and control. Organizations can adopt the AI Security Platform alone (free tier) or combine it with iboss's broader SASE capabilities.

Which AI services does iboss track?

ChatGPT, Microsoft Copilot, Gemini, Claude, Perplexity, and dozens of other services. Both browser-based tools and desktop AI applications including Cursor. New AI tools are automatically detected and classified as they appear on endpoints.