# SPM-002: Detect AI use at the browser point of use


- Area: AI Security Posture Management

- Verification: Live test
- OWASP adoption tier: AT0
- Formerly: DIS-002
- URL: /r/SPM-002

**Acceptance criteria:** Show visibility in Chrome, Edge, Safari and Firefox where supported, including prompt context and account plan.

**Why it matters:** The browser is where most employee AI use happens, so it is the first place visibility has to work.

**How to verify:** Pilot users' AI use in each supported browser appears with prompt context and account plan.

**OWASP adoption context:** The listed contexts focus on browser access to personal-account AI and vendor assistants; the supported browser and capture path still determine visibility.

**Mappings:**
- NIST CSF 2.0: DE.CM-03, DE.CM-09; ISO 42001: A.6.2.6 — Browser prompt and account-plan telemetry makes personnel use and AI runtime activity visible for operational monitoring. Coverage is limited to supported browsers, and visibility alone does not establish adverse-event analysis.
- SOC 2: CC7.2 — Point-of-use browser telemetry provides evidence for anomaly monitoring; the acceptance test does not require anomaly analysis or incident evaluation.
- ISO 27001: A.8.16 — Browser-use observations, including the prompt and account fields actually captured, provide application-activity signals for security monitoring. Demonstrate browser coverage, telemetry completeness and delivery to security analysis; visibility alone does not detect anomalies or prevent disclosure.