No new vendor onboarding, no agents, no project code. You own the log console; that is the entire prerequisite. Twenty minutes from export to a per-user inventory, and the first pass is free.
The practical end-to-end, from a console you know to a report you can forward.
Export 30 days from your DNS filter, proxy or firewall. Allowed traffic, identity column in. This is the longest step, and the per-vendor guides pin the exact fields.
Register with an email, drag the file onto the upload panel. The parser announces format and line count before running.
Matching runs against 20,399 classified AI domains. The upload itself is discarded. Free preview shows all totals plus the top tools named.
Read the tiles, count the masked rows, screenshot for the ops channel. Decide whether the full $99 report is warranted; most first runs answer that themselves.
Less "risk narrative", more "what do I do at the console". The sections in the order you will actually use them.
Once by risk for the block candidates, once by users for the procurement conversation. Both sorts come from the same CSV that ships with the full report.
Who reached what, with hit counts. Service accounts touching AI hosts are the sleeper finding: that is an integration someone built without a ticket.
Abusive and block-verdict domains, exact hostnames including api. and cdn. hosts, ready to paste into a custom category or blocklist.
Scope you can state in one line if anyone asks: hostnames, identities and timestamps only, no prompt content, upload discarded after the run, report deletable.
Three situations where having the inventory already run changes your week.
"What AI do we use?" lands on IT first, always. Answering same-day with a dated PDF, instead of promising a project, is how operators get remembered at budget time.
The moment a paste-into-chatbot incident surfaces, the first question is scope. A standing inventory turns a panicked week into a targeted afternoon.
Vendor consolidation talks go differently when you know four teams already pay for overlapping AI tools out of expense budgets nobody compared.
The eventual escalation path also starts here: the same report that serves you feeds the CISO's board slide. The CISO page shows where your twenty minutes end up.
Compare the paths to your first real AI inventory.
| Path | Time to first data | Procurement involvement | What it covers on day one |
|---|---|---|---|
| Log audit | Today, ~20 minutes | None for the preview; $99 fits most card limits | Full history of the logged network, retroactively |
| Endpoint agent rollout | Weeks to months | Full cycle, security review, pilot group | Managed devices only, from install day |
| CASB / SSE module | A quarter, optimistically | Platform negotiation | Brokered traffic, catalog-known apps |
| Survey | Two weeks of chasing | None | What people admit remembering |
The longer comparison, including when the heavier options genuinely win, is on the detection methods page.
Three pages of sample data, including the per-user table and the block-ready tool list. If it looks useful, your own version is twenty minutes away.
Block-verdict hostnames into your filter's custom category, sanctioned tools toward SSO. An hour of console work with the list open.
Same window next month or quarter. Blocked tools should show attempts only; if allowed hits persist, you found a bypass path for free.
Tools found, high-risk, sanctioned share, delta. Whoever you report to, that line fits their format. Costs stay flat: pricing.
That is your call and your org's policy. Many operators treat it like any other log analysis: existing data, existing access, read-only output. The one-line scope statement above usually settles it.
Whichever console you can reach fastest. DNS filter logs are usually the one-click option; the walkthrough has the per-source cheat sheet.
You still get the full tool inventory with per-IP attribution. DHCP reservations make the IP table readable enough for most decisions.
It generates a short block list and a shorter procurement list. Both replace diffuse worry with an hour of defined console work.
Free: 5,000 lines or 2 MB. Full report: 2,000,000 lines or 25 MB, larger on request via contact.
Every tool named instead of a fifth, the per-user table, the sanctioned split and the CSV. The free audit page has the exact split.
The console is already open in another tab. Twenty minutes from now, the guessing is over.
Run the free audit