9 of 9 requirements
Export view:Distinguish personal, free and guest accounts from sanctioned enterprise tenants
Report a reliable account-type split at the point of use and allow policy to vary depending on account plan.
- Why it matters
- Contractual protections attach to the enterprise tenant, not the domain. A personal account reaches the same URL with none of them.
- How to verify
- Enterprise, personal and unauthenticated use of the same tool are each identified and handled per policy.
Area: AI Security Posture Management
AI Detection & Response
IDR · 1Identify use cases leading to elevated risk behavior.
Surface the use cases and teams that require additional training on safe usage principles.
- Why it matters
- Repeat exposure and under-use point to where risk reduction or enablement will pay off.
- How to verify
- High-risk use cases and the associated users are identified in a pilot.
Area: AI Detection & Response
AI Usage, Spend & Value
VAL · 7- VAL-001Proof of value
Measure AI usage and adoption by tool, team, function and workflow
Report volumes, active users, trends and the sanctioned/unsanctioned split at privacy-appropriate aggregation.
- Why it matters
- Usage is the denominator for every cost, risk and value figure.
- How to verify
- Usage by tool, team and function from pilot data, at privacy-appropriate aggregation.
Area: AI Usage, Spend & Value
- VAL-002Proof of value
Classify AI activity into business-relevant use cases
Turn raw telemetry into recognizable tasks, workflows and functions.
- Why it matters
- Tool-level data cannot tell a team drafting contracts from one summarizing public research.
- How to verify
- Top use cases by function from pilot data, with personal conversations excluded.
Area: AI Usage, Spend & Value
- VAL-003Proof of value + Walkthrough
Measure spend, waste and portfolio decisions
Report licenses, tokens, provider cost, model efficiency, redundant tools and cost per task or outcome, and produce the evidence behind a decision to scale, pause, optimize or retire a tool.
- Why it matters
- License waste and duplicate tools are often the fastest way to fund the control.
- How to verify
- Licensed versus active use for one enterprise AI tool, and the cost method explained.
Area: AI Usage, Spend & Value
- VAL-004Proof of value
Measure productivity and business-value signals
Identify time saved, throughput, completion and quality indicators with stated assumptions.
- Why it matters
- Risk without value is a brake. Value without risk is a blind spot.
- How to verify
- Value indicators for pilot functions, shown with their assumptions.
Area: AI Usage, Spend & Value
- VAL-005Proof of value
Generate targeted training and enablement recommendations
Turn observed usage and detection telemetry into prioritized interventions, templates, coaching and sanctioned-tool adoption, aimed at the teams and behaviors that actually generate risk, and measure whether behavior changes.
- Why it matters
- Training aimed at the teams and behaviors that actually create risk works better than blanket training.
- How to verify
- Prioritized enablement recommendations from pilot data, and a measure of whether behavior changed.
Area: AI Usage, Spend & Value
- VAL-006Proof of value
Measure employee self-remediation
Record whether a warned user cancels, edits, redirects or proceeds, and calculate a remediation rate where privacy allows.
- Why it matters
- Self-remediation shows whether coaching changes behavior or just records it.
- How to verify
- Share of coached pilot interventions where the employee edits or cancels, and the trend over the pilot.
Area: AI Usage, Spend & Value
- VAL-007Walkthrough
Provide role-based dashboards and reporting, up to board level
Tailor views for Security, IT, GRC, Legal, executives and business units, filter by unit, tool, environment, owner and risk, and summarize adoption, risk, policy, incidents and recommendations with trends and supporting evidence.
- Why it matters
- Each audience, from SOC to board, needs its own view of the same data.
- How to verify
- The same pilot data shown through executive, function and security views.
Area: AI Usage, Spend & Value