ShadowAI Defense GitHub
← All detections
DET-NS-001 Netskope Application Connector config Severity: Informational

Netskope — AI SaaS application discovery via Cloud Confidence Index

Discovers AI and generative AI applications in use across the organization by leveraging Netskope's Cloud Confidence Index (CCI) catalog and real-time traffic analysis.

Rule

# Netskope — Cloud Confidence Index (CCI) AI application discovery
# Navigation: Netskope Tenant UI > Settings > Security Cloud Platform > App Definition
#
# Discovery configuration:
#   - Enable Cloud Confidence Index (CCI) scoring for all discovered applications
#   - Filter applications by tag: 'Generative AI'
#   - Supplementary tags to include: 'AI/ML', 'AI Code Assistant', 'AI Productivity'
#
# App Instance classification:
#   - Sanctioned: enterprise-contracted AI tools (e.g., Azure OpenAI, enterprise Copilot)
#   - Monitored: AI apps under evaluation by AI Governance team
#   - Unsanctioned: consumer AI tools not approved for corporate use
#
# Alert policy (Policies > Real-time Protection):
#   - Name: Shadow AI Discovery Alert
#   - Condition: App tag IN ('Generative AI', 'AI/ML', 'AI Code Assistant')
#     AND App instance = 'Unsanctioned'
#     AND Activity = 'Access' OR 'Upload'
#   - Action: Alert (do not block at discovery stage)
#   - Notification: Send to AI Governance triage queue via webhook/email
#
# Reporting:
#   - SkopeIT > Applications: filter by Generative AI tag
#   - Dashboard: create custom widget showing AI app usage trends per department
#   - Export weekly discovery report to AI Governance team

How it works

Netskope's CCI catalog rates thousands of cloud applications on security, auditability, and business readiness. Applications tagged as Generative AI, AI/ML, and AI Code Assistant are automatically identified when traffic flows through the Netskope proxy. This discovery-only policy surfaces which AI services employees are using without blocking, providing the initial inventory for a Shadow AI governance program. Pair with DET-NS-002 and DET-NS-003 to add DLP and enforcement layers.

Required data sources

  • Netskope Cloud Exchange or inline proxy (forward/reverse proxy mode)
  • Netskope CCI catalog (updated automatically by Netskope)

Prerequisites

  • Netskope Intelligent SSE licensed (CASB + SWG at minimum)
  • Netskope Client (formerly Netskope Secure Client) deployed to managed endpoints
  • Steering configuration directing web traffic through Netskope proxy
  • CCI catalog access enabled (included with standard Netskope subscription)

Expected volume

Initial discovery: 30-100 AI applications within the first week. Steady-state: 2-8 new AI apps per week as the market evolves.

False-positive guidance

Netskope's CCI catalog may tag non-AI productivity tools that incorporate minor AI features. Review each discovered app before classifying. Some internal/custom apps may not appear in the CCI catalog and require manual app definition.

Tuning steps

  1. Review and classify all AI-tagged apps within 14 days of first discovery.
  2. Create custom app definitions for internal AI tools not in the CCI catalog.
  3. Sync app sanction status with the AI Inventory in the Governance Toolkit monthly.
  4. Adjust CCI score thresholds to reflect organizational risk appetite (e.g., block apps with CCI < 40).

Framework mappings

  • NIST AI RMF: GOVERN-4.1, MAP-1.1
  • ISO/IEC 42001: 8.2, 8.4
  • NIST CSF: DE.CM-7, ID.AM-2

Related AI Controls Catalog entries