NextDNS is the DNS filter small teams actually run: a profile per office or device group, logs in the dashboard, CSV a click away. That is a complete shadow AI sensor for a company with zero security headcount.
No SIEM, no syslog collector, no console permissions ceremony. NextDNS plus the audit is two dashboards and one CSV.
If NextDNS filters your office and laptops, the logging is on. There is nothing to deploy for the audit; the sensor has been recording since day one.
SMBs rarely run AD. NextDNS identities are profiles and device names, which is exactly the attribution a 40-person company needs: whose laptop, which office.
Small networks produce small logs. A week of a 40-person office often fits the free preview's 5,000 lines, making the first audit genuinely $0.
Open your profile's logs, set the time range, download CSV. The columns below are the ones the audit reads.
Device names become the per-source table. The Mobile profile row matters: that iPhone transcribes meetings wherever it is.
A creative agency: designers, copywriters, two founders, no IT staff. NextDNS on the office network and company laptops. Sample data, real shape.
A client's procurement form asks: "List AI tools used in service delivery." The founders realize they genuinely do not know. The form is due Wednesday.
One founder downloads seven days of NextDNS logs: 4,100 lines. Under the free cap, so the first pass costs nothing.
Free preview: 14 AI tools across 6 categories, top five named, nine masked rows. Two tools flagged as training on user data. The named five include an image upscaler nobody admitted to and the transcription app on a founder's own phone.
They buy one $99 report and re-upload a 30-day export, 16,800 lines. Full list: 19 tools. The per-device table shows the design studio's iMacs carrying most of the image-tool traffic, client work included. Exactly what the procurement form is asking about.
The founders sanction four tools with enterprise terms, drop two, and answer the client's form from the report CSV, with the PDF attached as evidence. Total spend: $99 and about two hours.
The client-questionnaire trigger is the most common SMB path to a first audit. The second most common: an invoice for an AI subscription nobody remembers approving.
NextDNS attribution is device-and-profile shaped. That maps to three useful readings.
Studio-iMac-2 living on image AI is a workflow fact. The conversation is about client-work terms, not about a person's browsing.
Office vs Mobile vs Guests. A transcription tool on the Mobile profile means meetings are being recorded off-premises, which is its own policy line.
SMB tool adoption is word-of-mouth: one designer finds a tool, three more follow within a month. Monthly free previews catch the spread while it is still one conversation.
| Report section | With a NextDNS CSV |
|---|---|
| Summary tiles | Complete totals: tools, high-risk, training exposure, abusive-purpose, unsanctioned. |
| Tool table | Every matched domain with category, risk, sovereignty and dated training verdicts. |
| Per-source table | Device names and profiles as sources, with tool counts and hits per device. |
| Sanctioned split | Your approved list against observed use; SMBs usually build the list from run one. |
| Blocked evidence | Status column preserved if you already block categories or lists. |
| CSV + PDF | Full-report tier: the PDF answers client questionnaires, the CSV feeds your own sheet. |
The uploaded CSV is read once and discarded. Reports stay 90 days in your account, deletable earlier. Registration for the free tier needs only an email address.
Three pages, sample data: tiles, the tool table with training verdicts, the per-source breakdown. If a client form is due Wednesday, this is your template answer.
The logs view of your profile has a download option over a time range. One file per profile; upload them separately or concatenated.
Concatenate for one company-wide report, or run per profile for per-surface trends. Both fit the caps at SMB scale.
For a first look, yes, and it usually fits the free tier. For client questionnaires and baselines, use 30 days in a full report.
Yes, as sources in the per-device table, inside your account only. Rename devices in NextDNS first if you want the table readable.
$99 once for one report, no subscription. The agency scenario ran its entire compliance answer on one report; packs exist if audits become routine. See pricing.
Blocking handles categories it knows; the audit inventories what actually happened, including embedded AI and new tools. Measure first, then tune blocking: the sequencing argument.
SMB security works when it fits inside existing habits. This one fits between coffee and stand-up on the first Monday.
Download last month's CSV from each profile. Same window every time: first to last of the month.
Upload, run the preview, screenshot the tiles into the ops channel. New tools since last month get a one-line mention.
If a tile turned red or a client form is pending, upgrade that run to a full report. Otherwise archive the preview PDF and done.
Three free previews a month is exactly a monthly cadence with two spares. The cap and the habit were made for each other.
SMBs do not need a governance framework to act on their first report. They need five rows in the handbook.
| Rule | Where the report feeds it |
|---|---|
| Client work goes only into sanctioned tools. | The sanctioned split shows the gap between rule and reality each month. |
| The sanctioned list lives in the handbook, five tools max. | Pick them from the tool table's low-risk, no-training rows. |
| Anything that records meetings needs a founder's sign-off. | Transcription rows in the report, like the founder's own iPhone in the scenario. |
| New tool requests take one Slack message, answered in a day. | Fast sanctioning is what keeps people from not asking. |
| The audit runs monthly and nobody gets ambushed by it. | Per-device rows start coaching conversations, not disciplinary ones. |
Building the sanctioned list properly, including what "enterprise tier with no-training terms" means, is covered on sanctioned vs unsanctioned AI.
Download a week of NextDNS logs and upload them. The agency answered a client questionnaire from a Friday-afternoon start.
Run the free audit