Detect endpoint AI activity beyond the browser

Acceptance criteria

Identify desktop clients, IDEs, coding assistants, CLI tools and local agents on managed Windows and macOS endpoints.

Why it matters

Desktop apps, IDEs and CLI tools carry a growing share of AI use, and browser-only controls never see them.

How to verify

Desktop assistants, coding tools and CLI tools used by pilot users appear, attributed to user, device and application.

OWASP adoption context

Endpoint inspection complements browser visibility for shadow applications and code-executing agent activity on employee devices.

Framework mappings

• NIST CSF 2.0 ID.AM-02, DE.CM-03, DE.CM-09ISO 27001 A.5.9, A.8.16

  Finding desktop, IDE, CLI and local-agent activity fills software-discovery and monitoring gaps beyond browsers. These observations must feed maintained, owned inventory records and analysis; identification alone establishes neither.

• ISO 42001 A.6.2.6

  Visibility into AI clients and processes on managed endpoints contributes to in-life operation monitoring, subject to demonstrated Windows and macOS coverage.

• SOC 2 CC2.1, CC7.2

  Endpoint findings supply control information and monitoring inputs for otherwise hidden AI use. Client identification alone does not demonstrate suspicious-activity analysis.