AI security
Secure how your people and computers use AI.
Lavawall also shows how an organization's people and computers use AI, from shadow AI sign-ups to AI agents on managed Windows computers, and maps that evidence to six AI governance frameworks, including NIST AI RMF and ISO/IEC 42001. Lavawall secures how your organization uses AI tools. It does not test or protect AI models or applications you build, and it does not filter prompts or block AI traffic.
Last updated
Where AI risk shows up and what Lavawall® shows
| Where AI shows up | What Lavawall shows | Where to read more |
|---|---|---|
| AI services staff sign up for | Each AI app found in email metadata, who uses it, and whether it is approved | SaaS Discovery |
| AI agents installed on computers | Coding assistants and agent tools on managed Windows computers, what they can reach, and set-ups that act without asking | Agentic AI discovery |
| AI apps with access to mail and files | AI apps and agents connected to Microsoft 365 and Google Workspace, and whether they can read mail and files | AI governance |
| Microsoft 365 Copilot and Gemini | Whether Copilot and Gemini activity is recorded, and whether the misuse attempts Copilot flags are reviewed | AI governance |
| AI browser extensions | Extensions that can read every website a person visits | AI governance |
| AI services on your network | AI services listening on computers or open on the internal network | AI governance |
| AI services on the internet | Model servers, AI chat interfaces and notebooks the domain scan finds exposed | Domain security scanner |
| People | AI risk courses by industry, and a course for people who build AI features and agents | Security awareness training |
From inventory to governance
Every check keeps a dated history and counts toward each AI framework that asks for the same control: NIST AI RMF 1.0, ISO/IEC 42001, ISO/IEC 27090, EU AI Act readiness, the OWASP Top 10 for LLM Applications and Canadian AI governance. Lavawall GRC also produces the AI acceptable use policy your team signs.
Your data and Lavawall’s own AI
Some Lavawall features, such as ticket triage and incident analysis, use AI. It runs in the same region as your data, which is Canada by default, sensitive identifiers are protected before anything reaches a model, and no client data is used to train any model. Data residency
Frequently asked questions
What does securing AI use mean?
Securing AI use means knowing which AI tools your people and computers use, what company data those tools can reach, and whether each one is approved, then backing that with a policy and training. Lavawall gathers that evidence from email, Microsoft 365, Google Workspace, computers and the internet.
Is Lavawall an AI firewall or an AI model security tool?
No. Lavawall secures how your organization uses AI tools. It does not test or protect AI models or applications you build, and it does not filter prompts or block AI traffic.
How do you detect shadow AI?
Shadow AI leaves traces in sign-up and notification email, in AI apps granted access to Microsoft 365 or Google Workspace, in browser extensions and in tools installed on computers. Lavawall matches email metadata against 1,277 known SaaS and AI apps and names each user, and lists AI agents on managed Windows computers.
Which AI governance frameworks does Lavawall support?
Six: NIST AI RMF 1.0, ISO/IEC 42001, ISO/IEC 27090, EU AI Act readiness, the OWASP Top 10 for LLM Applications, and Canadian AI governance. They share one control set with the other frameworks in Lavawall GRC (over 160 in all).
Do staff get training on AI risk?
Yes. The Training & Phishing plan includes AI risk courses by industry and a course for people who build AI features and agents. It is C$1.95 / US$1.50 per user per month, or included in Complete.
Does Lavawall use AI on my data?
Some Lavawall features, such as ticket triage and incident analysis, use AI. It runs in the same region as your data, which is Canada by default, sensitive identifiers are protected before anything reaches a model, and no client data is used to train any model.
Which Lavawall plan do I need for AI security?
SaaS Discovery and agentic AI discovery are included in Professional and Complete. AI governance frameworks are part of the Compliance/GRC package, and AI training is in the Training & Phishing plan.