Discover AI Usage Across Your Organization
September 22, 2026

Shadow AI Is Becoming a Visibility Challenge for Enterprises

Shadow AI Is Becoming a Visibility Challenge for Enterprises

AI adoption is expanding rapidly across organizations, but IT teams may not always have a complete view of where AI is being used. Employees can access public AI tools, browser-based applications, local AI models, and automation platforms outside traditional software procurement processes.

Larridin’s September 2026 analysis highlights this growing visibility challenge, citing Writer’s 2026 enterprise AI adoption research, which found that 35% of employees had entered proprietary information into public AI tools. The same research found that 67% of executives believed their organization had experienced a data leak or security breach because of an employee using an unapproved AI tool.

The Challenge of Building an AI Inventory

Traditional software inventories are built around applications that IT teams install, manage or approve. AI usage can be much broader because employees can access tools directly through browsers or adopt new AI services without going through established procurement processes. This makes it difficult to understand which AI applications are being used, how they are being accessed, and whether they are sanctioned by the organization. Larridin also reports that enterprise monitoring can uncover three to five times more AI usage than organizations initially expect.

An accurate inventory is an important starting point for AI governance. Before an organization can review how an AI application is being used, assess its relevance to internal policies, or determine whether additional controls are required, it needs visibility into what is actually present across the environment. This becomes increasingly important as AI usage expands beyond traditional installed applications. A broader view needs to include both managed and browser-accessed AI activity.

AI Usage Extends Beyond Installed Applications

AI applications are no longer limited to software installed directly on employee devices. Employees can interact with AI through websites, browser-based applications, automation platforms and locally running language models. These different access methods can create separate areas of AI activity that are difficult to understand through conventional application inventories alone. Identifying these sources provides a more complete view of how AI is being used across an organization.

Google Endpoints Readiness Tool’s AI Insights section provides visibility into AI usage across the organization to support AI governance and decision-making. It brings together information about installed AI applications, web-accessed AI, local AI models, and workflow automation platforms. Organizations can also view direct and indirect AI usage and understand the governance status associated with identified AI applications. This gives IT teams a centralized view of AI activity instead of relying only on known or manually reported applications.

From Organization-Level Visibility to Device-Level Details

Understanding the overall AI footprint is only the first step. IT teams may also need to determine where specific AI activity is occurring and what applications or platforms are involved on individual devices. Google Endpoints Readiness Tool allows administrators to drill down from organization-level AI insights into device-level details, providing additional context around the AI activity detected on each device. This helps connect broad AI usage patterns with the specific devices and applications behind them.

Device-level insights can include installed AI applications, web-based AI applications, local AI models, and agentic automation platforms. Administrators can also review information such as AI categories, usage types, governance status, and application usage details. This level of visibility can help teams identify where AI is being used and understand the different ways employees interact with AI tools. It also provides a more practical starting point for reviewing individual areas that require attention.

Supporting AI Governance with Sanctioning

Visibility becomes more useful when organizations can apply their own governance context to the AI activity they discover. Google Endpoints Readiness Tool’s Report Generator includes AI Sanctioning, where administrators can review discovered AI applications, workflow platforms, local LLMs, and browser-integrated AI. These items can be classified as Sanctioned or Unsanctioned, helping organizations distinguish tools that have been approved from those that may require further review. Administrators can also configure whether identified AI activity is considered direct or indirect where applicable.

This classification does not determine whether an AI application should ultimately be allowed or restricted. Instead, it gives organizations a structured way to understand their AI footprint and identify applications that may need additional assessment. Combined with device-level visibility, sanctioning helps connect AI discovery with the organization’s own governance approach. The result is a more contextual view of AI activity across the environment.

Turning AI Visibility Into Readiness Insights

AI adoption will continue to introduce new applications, workflows, and ways of working. As this happens, relying only on manually maintained software inventories can make it harder to understand the actual AI landscape within an organization. Continuous visibility can help IT teams identify AI activity across different access methods and understand where additional governance review may be needed.

AI Insights in Google Endpoints Readiness Tool brings this visibility into a broader readiness assessment, helping organizations understand AI activity across their environment. From installed applications and browser-accessed AI to local models, workflow platforms, and governance classifications, Google Endpoints Readiness Tool provides the insights needed to build a clearer picture of AI usage. Explore AI Usage Insights with Google Endpoints Readiness Tool. Visit Google Endpoints Readiness Tool

Frequently Asked Questions

What is Shadow AI?

Shadow AI refers to AI tools or services used within an organization without going through established IT approval or governance processes.

Why is AI visibility important?

Visibility helps organizations understand which AI tools are being used, how they are accessed, and where additional governance or review may be required.

What does Google Endpoints Readiness Tool AI Insights identify?

Google Endpoints Readiness Tool AI Insights provides visibility into installed AI applications, web-accessed AI, local AI models, workflow platforms, and AI usage and governance information.

Can Google Endpoints Readiness Tool show AI usage at the device level?

Yes. Google Endpoints Readiness Tool allows administrators to drill down into individual devices to review detected AI applications, web-based AI, local models, and automation platforms.

Can administrators classify AI applications?

Yes. Google Endpoints Readiness Tool’s Report Generator provides AI Sanctioning options that allow administrators to classify identified AI applications and related AI technologies as Sanctioned or Unsanctioned.

Senuri Senevirathna

Google Endpoints Readiness Tool

Related Blogs

From Windows to Chromebooks: What MedXM Shows About Migration Readiness
September 16, 2026

From Windows to Chromebooks: What MedXM Shows About Migration Readiness

Moving from traditional Windows environments to Chromebooks can help organizations simplify how employees work, reduce software dependency, and support a more cloud-first workplace.

A real example is MedXM, a U.S. healthcare organization that previously relied on Windows machines, Microsoft Office, and VPN access for employees. MedXM moved toward Chrome Enterprise technologies including Chromebooks, Chrome Browser, and Google Works  pace to create a more streamlined working environment.

The results show what a successful endpoint modernization strategy can look like. But for another organization considering the same direction, the first question should be:

Is our current environment actually ready to move from Windows to Chromebooks?

That readiness question is exactly where Chrome Readiness Assessment (CRA) fits. CRA is an enterprise readiness assessment platform that helps IT and security teams understand whether their current environment is ready for Chrome Enterprise Premium, ChromeOS, and secure enterprise browsing. For organizations considering a Windows-to-Chromebook transition, CRA helps turn that broader readiness question into practical visibility around application and device readiness, showing what may be ready to move, what needs verification, and where potential blockers require attention before rollout. 

MedXM’s Move Away From a Traditional Windows Environment

MedXM previously operated with Windows machines equipped with Microsoft Office, while healthcare workers and remote employees also relied on VPN access to reach the company network. The additional steps made everyday work slower and more complex.

MedXM introduced Chromebooks, Chrome Browser, and Google Workspace as part of its move toward a more cloud-based environment.

According to the customer story, MedXM:

  • Reduced software-related expenses by 40%

  • Made routine employee tasks faster through cloud technology

  • Improved collaboration through Google Workspace

  • Planned to replace additional outreach-center and clinician computers with Chromebooks

Explore the MedXM Chrome Enterprise customer story

The story demonstrates the potential business value of moving away from a heavily desktop-dependent environment.

But reaching that point requires more than selecting new devices.

A Chromebook Rollout Starts With Knowing What Can Move

Every Windows environment is different.

Some employees may already spend most of their day in browser-based applications and cloud services. Their transition to Chromebooks may be relatively straightforward.

Others may rely on Windows applications, specialized software, peripherals, or workflows that require additional review.

That means an organization cannot assume every user or device should migrate at the same time.

Before investing in a wider Chromebook rollout, IT teams need to understand:

  • Which applications are already suitable for ChromeOS

  • Which applications need further verification

  • Which applications may create migration blockers

  • Which devices and user groups may be stronger candidates for an earlier move

  • Where additional planning is needed before migration

This is where readiness data becomes important.

CRA Helps Assess the Environment Before the Move

Chrome Readiness Assessment helps organizations understand their existing environment before moving users from Windows to ChromeOS.

CRA evaluates application readiness using clear categories:

Chrome Ready : applications with strong ChromeOS readiness

Possibly Ready: applications that require additional review or verification

Blocker: applications that may prevent or complicate migration

Unknown: applications where readiness information still needs to be reviewed

These categories help IT teams identify where migration may be straightforward and where further investigation is needed before rollout.

CRA also helps teams review device readiness so the migration does not have to be treated as one organization-wide switch.

Instead, organizations can begin building migration waves around actual readiness.

See how CRA supports ChromeOS readiness planning

From a Customer Success Story to a Practical Migration Plan

MedXM shows the outcome organizations may be working toward: a more cloud-first environment built around Chromebooks, Chrome Browser, and modern productivity tools.

CRA focuses on the stage before that transformation.

For an organization currently operating a large Windows fleet, CRA helps answer practical questions such as:

“Which users could move first? Which applications still depend on Windows? Where are the issues?”

Instead of beginning migration with assumptions, IT teams can use readiness insights to decide where the transition can start and where more preparation is required.

Why Readiness Matters Before Replacing Windows Devices

A Windows-to-Chromebook migration affects more than hardware.

Applications, user workflows, access requirements, peripherals, and existing dependencies all influence whether the change works smoothly for employees.

If those dependencies are discovered only after Chromebooks have already been deployed, IT teams may face avoidable disruption and support pressure.

CRA helps surface those issues earlier.

The goal is not simply to determine whether ChromeOS is suitable for the organization. It is to understand which parts of the organization are ready for ChromeOS today and which parts need more preparation.

From Windows Complexity to Readiness-Based ChromeOS Adoption

MedXM’s experience shows how moving toward Chromebooks and cloud-first tools can support a simpler way of working. The organization reported lower software-related expenses, faster routine tasks, and plans to expand Chromebook adoption further.

For organizations considering a similar transition, readiness should come first.

Chrome Readiness Assessment helps teams evaluate their current Windows environment, identify application and device readiness, surface potential blockers, and plan a more practical path toward Chromebook adoption.

The goal is not to move every device at once. It is to understand where the organization is ready to move first.

FAQ

Did MedXM use Chrome Readiness Assessment?

The MedXM customer story does not state that MedXM used CRA. The case study is used as a real-world example of an organization moving from a Windows-based environment toward Chromebooks and Chrome Enterprise technologies.

How does CRA connect to the MedXM use case?

CRA supports organizations considering a similar Windows-to-ChromeOS transition by helping them evaluate application and device readiness before rollout.

Can CRA identify applications that may affect ChromeOS migration?

Yes. CRA categorizes applications as Chrome Ready, Possibly Ready, Blocker, or Unknown so IT teams can identify where additional review may be needed.

Does every Windows device need to move to a Chromebook at the same time?

No. Readiness visibility can help organizations plan migration in stages, moving stronger candidates first while reviewing applications, devices, or workflows that still require attention.

Gain Better Visibility and Governance Over AI Usage With CRA AI Insights
September 14, 2026

Gain Better Visibility and Governance Over AI Usage With CRA AI Insights

Artificial intelligence is becoming a regular part of how employees work. From browser-based AI assistants and installed AI applications to local LLMs and workflow automation platforms, AI tools are appearing across enterprise environments faster than many organizations can track.

The challenge is not simply knowing that AI is being used. It is understanding what AI tools are being used, how they are being accessed, whether they are approved, and where governance gaps may exist.

To help organizations address this challenge, Chrome Readiness Assessment (CRA) is introducing AI Insights, a new capability designed to provide visibility into AI usage across devices, browsers, and applications while supporting governance through AI sanctioning controls.

A Unified View of AI Usage Across Your Organization

AI tools can enter the workplace through multiple channels.

Some are installed directly on employee devices. Others are accessed through browsers. Employees may also use local AI models or connect AI-powered workflow automation platforms to business processes.

AI Insights brings these different sources together into a single view, helping organizations understand:

  • Installed AI applications across devices

  • Web-accessed AI applications used through browsers

  • Local AI models (LLMs) running on endpoints

  • AI workflow and automation platforms

  • Direct and indirect AI usage patterns

  • Approved (sanctioned) and unapproved (unsanctioned) AI tools

This provides a clearer picture of how AI is being adopted throughout the organization.

Understand AI Activity at a Glance

The AI Insights dashboard provides a consolidated overview of AI usage across the environment.

Organizations can quickly view:

  • Total installed AI applications detected

  • Browser-accessed AI applications

  • Local AI models discovered on devices

  • Workflow automation platforms in use

  • Direct and indirect AI application counts

  • Sanctioned and unsanctioned AI usage statistics

Rather than manually gathering information from multiple sources, teams can review AI activity from a centralized dashboard and identify areas that may require further investigation or governance.

Drill Down Into Device-Level AI Usage

Visibility becomes more valuable when organizations can understand AI usage at the device level.

AI Insights provides detailed device-level views that allow teams to review:

  • Installed AI applications on individual devices

  • Browser-accessed AI tools used by employees

  • Local AI models detected on endpoints

  • Workflow platforms associated with each device

  • Direct and indirect AI usage classifications

  • Governance status, including sanctioned and unsanctioned items

This helps security, IT, and governance teams understand where AI is being used and which devices may require additional review.

Differentiate Between Direct and Indirect AI Usage

Not all AI interactions occur in the same way.

AI Insights distinguishes between:

Direct AI Usage

Direct AI usage refers to applications specifically designed as AI tools or AI-powered solutions.

Examples may include:

  • ChatGPT

  • Gemini

  • Perplexity

  • AI coding assistants

  • Dedicated AI productivity applications

Indirect AI Usage

Indirect AI usage refers to traditional applications or services that incorporate AI functionality as part of a broader product experience.

Examples may include:

  • Productivity platforms with embedded AI features

  • Browsers with built-in AI assistants

  • Business applications enhanced by AI capabilities

This distinction helps organizations better understand how AI enters everyday workflows and where governance policies may need to be applied.

Manage AI Governance Through AI Sanctioning

Visibility alone is not enough. Organizations also need a way to define which AI tools are approved for use.

AI Insights introduces an AI Sanctioning workflow within CRA's Report Generator, allowing organizations to review discovered AI technologies and determine whether they should be sanctioned or unsanctioned.

Items can be categorized and governed across multiple areas, including:

AI Applications

Installed AI applications discovered across devices can be reviewed and marked as sanctioned or unsanctioned according to organizational policy.

AI Workflow Platforms

AI-enabled workflow and automation platforms can be evaluated to determine whether their usage aligns with governance requirements.

Local LLMs

Locally installed AI models and LLM frameworks can be identified and reviewed to ensure compliance with security and governance standards.

Browser-Integrated AIs

Modern browsers increasingly include built-in AI assistants and copilots.

AI Insights identifies browser-integrated AI capabilities such as:

  • Gemini in Chrome

  • Copilot in Microsoft Edge

  • Leo in Brave

  • Firefox AI assistant capabilities

  • Aria in Opera

Organizations can review these browser-integrated AI features and determine whether they should be sanctioned for use within the environment.

Track Sanctioned and Unsanctioned AI Usage

Once governance decisions are defined, AI Insights reflects those decisions throughout reporting and device-level views.

Organizations can quickly identify:

  • Sanctioned AI tools approved for business use

  • Unsanctioned AI tools that may require review

  • Devices using unapproved AI technologies

  • Governance trends across departments and user groups

This enables teams to move from simple discovery toward active AI governance.

Helping Organizations Build Responsible AI Adoption Strategies

AI adoption is accelerating across every industry. The organizations that succeed will be those that can balance innovation with visibility, governance, and control.

With AI Insights, Chrome Readiness Assessment helps organizations understand AI activity across their environment, distinguish between different types of AI usage, and establish governance through sanctioning workflows and reporting.

By providing visibility into installed AI applications, browser-accessed AI tools, local LLMs, workflow platforms, browser-integrated AI capabilities, and governance status, AI Insights helps organizations make more informed decisions about AI adoption at scale.

CRA MCP for AI-Connected Readiness Insights and Controlled Actions
September 11, 2026

CRA MCP for AI-Connected Readiness Insights and Controlled Actions

For IT professionals, readiness reports provide valuable insights, but finding the right information can take time.

Chrome Readiness Assessment gives organizations a detailed view of their environment and helps teams understand their overall readiness. But when a user needs one specific answer, they may still need to move through multiple report sections before finding it.

CRA MCP introduces a new way to work with that readiness data. It brings Model Context Protocol support into the CRA Report Generator, allowing tested MCP-compatible clients to connect to the current generated CRA report through a controlled MCP Server.

The report-querying and data retrieval flow has currently been tested with CommandLyne and the Claude Desktop app. With this connection, users can ask natural-language questions, explore follow-ups, and receive focused answers based on CRA readiness data. Instead of manually searching through the report, teams can ask the report what they need to know.

CRA MCP also brings readiness intelligence closer to action. Where approved, CEP enrollment token deployment can be supported through a separate Device Action Tools section. This deployment capability is currently in beta and is supported through CommandLyne only.

CRA MCP is not just about making reports easier to read. It helps teams move from readiness data to controlled next steps while keeping setup approval, MCP access control, tool-level confirmation, and deployment visibility inside CRA.

What Is CRA MCP?

CRA MCP is a new integration feature that allows supported AI agents to interact with CRA readiness data through an MCP Server inside the Report Generator.

Instead of manually searching through different report sections, users can connect a tested MCP client and ask questions about the current generated report. At this stage, the report-querying experience has been tested with CommandLyne and the Claude Desktop app. 

For example, a user may want to know which devices are blocked, which applications need review, what browser risks were found, which workflows show automation activity, or what is affecting CEP readiness. CRA MCP allows the connected client to request the right information from the report and return a focused answer.

The Report Generator remains the source of truth. The MCP Server controls access. The connected MCP client provides the conversational experience.

From Static Reports to Askable Readiness Data

Traditional reports are useful, but they depend on the user knowing where to look.

CRA MCP makes the report more interactive. Instead of opening multiple pages, filtering tables, and reading through different sections, users can ask direct questions and receive data-backed responses.

This helps different teams use the same report in different ways.

An IT administrator can ask for technical blockers. A manager can ask for a short readiness summary. A security team can ask about browser and extension exposure. A partner can ask for the main customer risks and the next areas to review.

The same readiness report becomes easier to explore because users can ask for the exact view they need.

Remote Device Actions Start With Setup Approval

Before device actions can be used, CRA requires approval during the setup flow.

In the installation or wizard process, the user must allow Remote Device Actions. This approval authorizes the Report Generator on that machine to send signed configuration actions to devices in the current installation round.

This is an important control point.

Remote Device Actions do not mean CRA can send any command to a device. The flow is limited to supported built-in actions. Instructions are signed, devices pick them up during their check-in cycle, and outcomes can be reviewed later.

Once this setup approval is completed, the MCP Server and Actions capabilities become available in the Report Generator.

How the MCP Server Works

The MCP Server sits inside the CRA Report Generator as a controlled connection layer.

When the MCP Server is enabled, users can create access tokens for tested MCP clients. These tokens allow approved clients, such as CommandLyne or the Claude Desktop app, to connect to CRA and request information from the current generated report.

The connected client does not directly own the CRA data. It sends a request through the MCP Server. The MCP Server validates access, checks whether the requested tool is available, retrieves the supported information from the current report, and returns only the relevant data.

The flow is simple:

User asks a question → AI agent sends the request → MCP Server validates access → CRA Report Generator provides the report data → AI agent returns the answer

This gives users a natural-language experience while keeping CRA as the trusted source of readiness information. 

Access Tokens Keep AI Connections Controlled

CRA MCP does not open report access automatically.

Users must enable the MCP Server and create named access tokens for the MCP clients they want to connect. The report-querying and data retrieval flow has currently been tested with CommandLyne and the Claude Desktop app.

This gives organizations control over which tested clients can connect to CRA.

Access can also be removed when needed. If a token is revoked, the connected client can no longer access CRA readiness data through that token.

This matters because CRA reports may include sensitive environment information, such as device status, application usage, browser risks, migration blockers, workflow activity, and CEP readiness. Token-based access keeps the AI connection useful without making it uncontrolled.

Device Action Tools Add a Controlled Next Step

CRA MCP also includes a separate section called Device Action Tools.

This is different from the read-only MCP tools.

Read-only tools help users retrieve and understand report data. Device Action Tools can support a specific approved action when the organization enables them.

These tools are not available by default. The deploy_chrome_enrollment_token tool is available under the Device Action Tools section within the MCP Server page. This CEP enrollment token deployment capability is currently in beta and is supported through CommandLyne only.

To enable the CEP enrollment token action, the user must select the action tool under Device Action Tools. When the user selects the tool, CRA shows a warning modal asking whether AI clients should be allowed to use that action.

This creates another approval layer.

If the user confirms, the selected CEP enrollment token action tool becomes available through the approved CommandLyne MCP flow. If the user does not confirm, the tool remains disabled.

This means the AI agent is not given general device control. It can only call the specific CEP enrollment token action tool that has been approved.

Deployment Tracking Stays Inside the Report Generator

Actions triggered through MCP do not disappear into the background.

After the approved CommandLyne agent deploys the CEP token, the user can go to the Actions page and open the Deployments tab. There, the deployment card appears for the enrollment token action.

The card shows the deployment summary, including how many instructions were published and how many are still pending. Users can then view the devices connected to that deployment.

Inside the device list, users can see which devices are pending, which devices have applied the action, and which devices are still waiting for check-in. Device-level details also help teams review information such as the device name, group, action type, published time, expiry, last upload time, reported outcome, agent version, and action history.

This keeps the process transparent.

Even when the action is triggered through CommandLyne, the Report Generator still gives users a place to verify progress and confirm the outcome.

Business Value of MCP Device Action Tools

The business value of CRA MCP is that it connects readiness insight with controlled execution.

A readiness report can show what needs attention. An AI agent can help explain the finding. A controlled Device Action Tool can then support a specific approved next step.

This reduces the gap between analysis and action.

For IT teams, it means less time moving between report review and operational follow-up. For security and management teams, it means AI-supported workflows can still stay inside approved boundaries. For partners, it creates a stronger customer experience because the discussion can move from “what did the report find?” to “what controlled next step can we take?”

Because the CEP token deployment flow is currently in beta, it also creates a foundation for future expansion. More supported actions can be introduced later while keeping the same control model: setup approval, MCP access control, tool-level confirmation, and deployment tracking.

CRA MCP brings readiness intelligence closer to action while keeping approval, access control, and deployment visibility inside the Report Generator.

Not General AI Control

CRA MCP should not be understood as open-ended AI control over devices.

The AI agent cannot freely change CRA data, run arbitrary commands, or perform unrestricted device operations.

Read-only MCP tools are used to query and summarize report data. Device Action Tools are separate, disabled by default, and only available after explicit approval. The current CEP token deployment capability is beta and limited to the approved CommandLyne flow.

This separation makes the feature practical for enterprise environments. Teams can benefit from AI-assisted readiness exploration while keeping action boundaries clear.

Manual Deployment Is Still Available

CRA MCP supports AI-connected workflows, but users do not have to use an AI agent for every action.

Users who prefer a manual flow can go to the Actions area in the Report Generator, choose the supported action, configure the required details, and deploy it directly from the interface.

This manual path is useful when teams want to handle the action themselves while still using the Report Generator to track deployment status.

From Readiness Reports to Readiness Intelligence

CRA MCP turns CRA reports into a more interactive layer of readiness intelligence.

The Report Generator continues to hold the trusted data. The MCP Server controls which tested clients can connect. Access tokens protect the connection. Read-only tools provide focused answers. Device Action Tools support approved next steps. The Actions page keeps deployment tracking visible.

Together, these capabilities make CRA MCP more than a report-querying feature.

It helps organizations ask better questions, understand readiness faster, and move toward controlled action with confidence. With the CEP token deployment capability currently in beta through CommandLyne, CRA also sets the foundation for more controlled action workflows in future releases.

FAQ

Which MCP clients are currently tested with CRA MCP?

The report-querying and data retrieval flow has currently been tested with CommandLyne and the Claude Desktop app.

What happens when the CEP enrollment token Device Action Tool is selected?

CRA displays a warning modal asking whether AI clients should be allowed to use that action. If the user confirms, the action becomes available through the approved CommandLyne MCP flow. If the user does not confirm, the tool stays disabled.

Can an AI agent deploy a CEP token?

Yes, where approved, but this capability is currently in beta and supported through CommandLyne only. The CEP enrollment token Device Action Tool must be enabled, confirmed, and accessed through a valid MCP token before CommandLyne can support the deployment action.

Will more Device Action Tools be added later?

Yes. The CEP token deployment flow is the current beta action, and future releases can expand the Device Action Tools area with more supported actions.

Download the Setup for FreeCheck your browser risk score in 30 seconds