A clear view of which AI tools employees use and how.
Bringing Shadow AI Under Policy for a Global Insurance Provider
Visibility and guardrails for how employees use generative AI.
Client context
The work begins with the operating reality.
Client
A global insurance provider with a distributed workforce adopting generative AI tools.
EngagementThe security team needed to see how employees were using AI and stop sensitive data from leaving through prompts, without banning AI outright.
The challenge
What had to change
Employees had adopted public and embedded AI assistants faster than policy could follow. The security team had no reliable inventory of which tools were in use, what data was entering prompts, or how to enforce acceptable-use rules consistently.
The BlueAlly solution
How the work came together
BlueAlly's Cyber practice matched the problem to WitnessAI, a focused control for how people use AI, and supplied the platform. WitnessAI observes AI usage across the workforce, applies policy to prompts and responses, and can allow, warn or block an interaction based on its intent. It stops sensitive data before it reaches external models and keeps an audit trail of AI conversations.
The results
What changed
The organization now has one place to see which AI tools are in use and to enforce guardrails on prompts, so it can enable approved AI tools instead of blocking them.
Outcome highlights
What the client gained.
Sensitive data stopped before it reaches external models.
Acceptable-use rules applied consistently across the workforce.
Approved AI adopted with guardrails rather than banned.
Related work
More outcomes in Cybersecurity
Cybersecurity
Strengthening Cybersecurity for a Biotech Company
Critical risks were identified and prioritized, with clearer protection against unauthorized access, email spoofing, and audit-readiness gaps.
Read the story
Compliance
Simplifying Compliance Management to Strengthen Outcomes
The company achieved and maintained SOC 2 and PCI compliance while improving continuity, operating efficiency, and institutional knowledge.
Read the storyHave a similar constraint?
We can start with the current state, the outcome, and the limits around time, risk, and budget.