Netskope introduces AI Discovery on the Netskope Client, a periodic signature-based scanning capability that detects AI agents, locally running Large Language Models (LLMs), local Model Context Protocol (MCP) servers, and AI extensions installed in web browsers and integrated development environments (IDEs).
Previously, administrators had no visibility into shadow AI assets: unauthorized or unmanaged AI applications, agents, and tools running on managed endpoints. This created significant security and governance blind spots, especially as end-users increasingly experiment with AI tools locally on their machines. With AI Discovery enabled, administrators can now automatically inventory AI assets across Windows and macOS endpoints and centrally visualize them in the AI Command Center (AICC)dashboard.
Administrators can enable AI Discovery through Client Configuration > AI Security webUI. When enabled, the Netskope Client periodically scans the endpoint and reports discovered AI assets to the cloud for centralized visibility and governance. Discovery results include AI agents, local LLM processes, local MCP servers, browser AI extensions (Chrome, Edge, Safari), and IDE AI extensions (VS Code, Cursor). Administrators can configure the scan interval (1 to 1,440 minutes; default: 60 minutes).
Prerequisites
-
Supported Operating Systems: Windows, macOS
-
Minimum Netskope Client Version: 138
-
Minimum Netskope Client Version (AI Agent Network Telemetry): 140.0.0
Enable AI Discovery
To activate AI Discovery, navigate to Settings > Security Cloud Platform > Netskope Client > Client Configuration > AI Security and select Enable AI Discovery. To learn more, view AI Security.
Assets Detected During AI Discovery
On each scan, the Netskope Client enumerates and reports the following:
| Asset Type | Detected Assets | Supported Minimum Client Version | Data Collected |
|---|---|---|---|
| AI Agents | Claude Desktop (Anthropic), ChatGPT Desktop (OpenAI), Microsoft Copilot, Claude Code, OpenClaw, Perplexity Comet AI Browser, Perplexity Desktop | 138.0.0 or later | Process name, PID,PPID,binary path, installation path, version (if available), connected MCP servers or LLMs (local connections only) |
| Codex (Open AI) | 142.0.0 | ||
| Locally Running Large Language Models (LLMs) | Ollama, LM Studio, Jan AI, GPT4All | 138.0.0 or later | Process name, PID, PPID, binary path, installation path, version, loaded models (name, family, size, format, parameter size — if discoverable) |
| IDE AI Extensions — VS Code | GitHub Copilot, Codeium, CodeWhisperer, Tabnine, Claude Code, IntelliCode | 138.0.0 or later | IDE name, PID, binary path, version; per extension: name, ID, description, publisher, version |
| IDE AI Extensions — Cursor | GitHub Copilot, Tabnine, Claude Code, Cline | 138.0.0 or later | IDE name, PID, binary path, version; per extension: name, ID, description, publisher, version |
| Browser AI Extensions — Chrome (Windows and macOS) | Monica, Sider, Perplexity, ChatGPT, Copilot, Speechify, Merlin, Grammarly | 138.0.0 or later | Browser name, PID, binary path, version; per extension: name, ID, description, version, installation path |
| Browser AI Extensions — Edge (Windows) | Monica, Sider, Perplexity, Grammarly | 138.0.0 or later | Browser name, PID, binary path, version; per extension: name, ID, description, version, installation path |
| Browser AI Extensions — Safari (macOS) | Monica, Sider, Grammarly | 138.0.0 or later | Browser name, PID, binary path, version; per extension: name, ID, description, version, installation path |
AI Agent Network Telemetry
In addition to the asset inventory, the Netskope Client can report network-level telemetry for the AI agents it discovers thereby giving administrators the visibility into when and how much those agents are actually communicating over the network.
Enable AI Agent Network Telemetry
There is no tenant WebUI configuration for AI Agent Network Telemetry yet.
Network Telemetry Data Collected per Connection
| Field | Description |
|---|---|
| Source IP / Port | The endpoint private IP address and source port |
| Destination IP / Port | The destination IP address and port |
| Destination hostname | The destination domain name, for public AI domain connections |
| Bytes in / out | Bytes transferred in each direction for the session |
| System ID | For loopback connections only; identifies the destination local LLM |
| Timestamp | When the connection was recorded |
Limitations
-
Windows and macOS only: Netskope supports AI Discovery on Windows (64-bit) and macOS endpoints only.
-
Multi-user environment limitation: In environments where multiple users share a single endpoint (such as shared workstations or terminal servers), AI Discovery is limited to scanning the default browser and IDE profile of the currently active logged-in user. The Client may not detect AI assets installed or configured by other users on the same device.
-
VM and Container AI assets: If AI LLMs or agents are running inside virtual machines or Docker containers deployed separately from the Netskope Client installation, those assets are not detected by the endpoint AI Discovery scanner (If the Netskope Client is installed inside the VM/Container, discovery operates normally within that environment).
-
Detection limited to AI signatures file: AI Discovery detects only those AI assets that are enumerated in the AI Signature file maintained by Netskope. Contact Netskope Support to update the signature file.