See the AI on your fleet - including the part your network can’t
Your AI inventory has a blind spot, and it’s exactly the shape of the tools that bypass your network monitoring. Every shadow-AI product watches traffic - they’re good at “someone pasted source into chat.openai.com.” None of them can see a model running entirely on a workstation, because there’s no traffic to inspect.
RFF closes that hole. It detects the AI tools, local model runners, and browser extensions across your Windows fleet using the inventory pass the agent already runs - content-blind, identity and metadata only, never a prompt or a byte of traffic. And it’s bundled free for your first 100 endpoints, not a separate platform.
Start free → · No credit card · Up in minutes
This isn’t a data-leak pitch - it’s an attestation one
Let’s be honest about the threat, because a sharp security lead will be: a local model is arguably the safest place for sensitive data. It never leaves the box. So if your only worry is exfiltration, the local model is the wrong villain - which is exactly why DLP and CASB tools ignore it.
The value isn’t fear. It’s completeness: you can’t govern what you can’t see, and you can’t attest to an inventory with a known hole in it. When an auditor, a board, or a cyber-insurance underwriter asks you to prove what AI is touching regulated data, “everything except the local stuff” is not an answer. RFF gives you the whole picture - including the one category every other tool structurally misses.
What it sees
- Installed AI apps - ChatGPT, Cursor, Copilot, Perplexity, Gemini and the rest, matched against the software inventory you already collect.
- Local model runners - Ollama, LM Studio, GPT4All, Msty, AnythingLLM, ComfyUI and more, by listening port and on-disk model directory. This is the part network tools can’t get.
- Browser AI extensions - the assistant extensions (Monica, Sider, Merlin, and friends) living in Chrome/Edge/Brave/Firefox profiles, read by manifest name only.
- Built-in Windows Copilot - Store/Appx apps the Win32 uninstall registry never shows.
Every detection carries a confidence tier. A distinctive name backed by the vendor’s publisher reads high; a collision-prone token alone (a mouse-cursor utility carrying “Cursor”) reads low and is never eligible for automated removal. Precision is the point - a false-positive uninstall on a clinical or production box is the case the whole design refuses.
Detection is free. So is governance.
Seeing what’s there shouldn’t cost extra, and neither does acting on it - all of this is on every plan, including Free:
- Sanctioned allow-list - bless a tool fleet-wide, or just for a group (“design can have Cursor; nobody else”). Anything unsanctioned shows as drift.
- One-click removal - reuses RFF’s fleet-uninstall engine; the agent resolves the uninstall locally, the server only ever ships a name.
- Approval-gated auto-remediation - an optional sweep that queues removals for an admin to approve, staged in canary rings with a health gate so one toggle can’t touch the whole fleet. Off by default.
- Compliance export - every AI surface on the fleet, sanctioned vs not, with who-blessed-what and when. The artifact you hand an auditor.
Honest about the edges
This is signature-based: RFF detects what’s in its catalog and says nothing about what isn’t. A determined user with a renamed binary evades until we catalog it. Anyone selling you complete shadow-AI detection is selling you a confidence they can’t have. What we’re selling is the inventory you didn’t have - including the local-model hole nobody else fills - and we’re honest about exactly where its edges are.
And it stays content-blind, forever. We detect that Ollama is present and whether it’s a version with a known CVE; we do not crack open the model weights or read a single prompt. If you need a platform that inspects content, that’s a DLP product - buy one. If you need to answer “what AI is running on my fleet,” including the stuff that never touches the network, that’s this.
RFF vs network/DLP-based AI discovery
| RFF | Network / DLP / CASB tools | |
|---|---|---|
| Cloud AI apps (ChatGPT, Copilot…) | Yes - installed-app + extension inventory | Yes - traffic + SaaS discovery |
| Local model runners (Ollama, LM Studio) | Yes - the differentiator | No - no traffic to inspect |
| On-disk models / Appx / browser extensions | Yes | Partial / no |
| Inspects prompts or content | No, by design | Often yes (that’s the category) |
| Sanction allow-list + one-click remove | Yes - every plan, Free included | Varies |
| Bundled into your RMM | Yes - free for 100 endpoints | No - separate platform |
FAQ
Does RFF read prompts or AI traffic? No. Content-blind by design - identity and metadata only. It’s the brand and the legal posture; it passes a privacy/works-council review.
How does it see local models if there’s no network traffic? Listening ports (Ollama’s 11434, LM Studio’s 1234, …), on-disk model directories, and runtime binaries - all collected on the box during the normal inventory pass. No traffic required, which is precisely why network tools can’t.
Is it really free? Yes, all of it, for your first 100 endpoints - detection and governance alike: sanctioning, removal, auto-remediation and compliance export. You pay when you outgrow 100 machines, not to unlock the useful half.
Want the engineering detail? The full write-up - signal priorities, the precision lock, and the not-DLP design - is on the blog: Finding shadow AI without reading a single prompt.