What is AIDR?

AIDR, or AI Detection and Response, is endpoint security for how a workforce uses AI: what employees send to AI tools, what those tools send back, and what AI agents do on the machine.

Why it needed a new name

The risk moved into content. A developer pasting a production database URL into a chat window is not anomalous at the process layer, the file layer or the network layer. It is an ordinary browser opening an ordinary TLS connection to a domain your allowlist already trusts, so every control in a normal stack looks straight at it and sees nothing.

Only the plaintext of the request tells you anything, and the endpoint is the one place that has it before it leaves. That is the whole reason the category sits beside EDR rather than inside a gateway.

The four layers

1. 01

   Visibility

   Every AI tool in use across the fleet, including the ones nobody declared. Discovery needs no plaintext, since a process and a destination are enough, so it reaches tools you have never heard of rather than only the ones already on your list.

2. 02

   Detection

   What is actually in the request: credentials in a pasted config, personal data in an uploaded spreadsheet, instructions hidden in a page an agent fetched. This needs the plaintext, which is why it happens on the device.

3. 03

   Response

   A timeline to investigate against, an alert into the tools you already run, and the ability to isolate a device. Detection without a response path is a report nobody reads on a Monday.

4. 04

   Governance

   One policy applied across every model, agent and integration, with each decision logged and exportable. The other three layers stand on this one.

How it differs from what you run

vs EDR

EDR asks whether a process is malicious. Nothing about a browser posting to a reputable domain is anomalous. The risk sits in the content of the request, which EDR has no reason to read.

vs Classic DLP

DLP watches the channels it was designed for: email, file shares, removable media. AI use is an interactive TLS session to a trusted domain, carrying content that was pasted rather than attached.

vs AI gateway or proxy

A gateway sees what is routed through it, which means the sanctioned API traffic and nothing else. Shadow AI is precisely the traffic that never gets routed through it.

vs Browser extension

An extension sees the browser. It does not see the ChatGPT desktop app, a coding assistant in an IDE, or a command-line agent, and those are where the highest-value context now travels.

The line that decides what a control can do

A guardrail can rewrite or refuse a request only while the bytes are still on the device and still unsent. After that point every control is alerting, because no product can un-send a prompt. Ask any vendor where their inspection happens: that single fact decides whether they can stop something or only tell you about it afterwards.

The second question worth asking is how much they see at all. Knowing that a tool is in use is a different fidelity from holding its plaintext, and the honest answer is that discovery covers everything while inspection covers what has been onboarded and tested. Sighted, recorded and inspected are the three states, and they are not interchangeable.

Keep reading

• AI App Risk Directory covers what leaks through each AI tool, and the guardrail that stops it.
• Glossary defines shadow AI, prompt injection, MCP, AI DLP and the rest.