AIGuard T1 — Govern the AI you can't see

From noise to signal — measured in production

13,700,000IP-BASED

→

501,017DNS-ONLY

Switching from IP-based to DNS-based detection removed 96–99% of false positives across major providers — and cut the sensor's memory footprint by 58×.

Why DNS

IP addresses lie. DNS tells you what a person intended.

AI providers run on shared cloud infrastructure. A single Microsoft IP range carries Copilot, Teams, Outlook, and SharePoint at once — so flagging traffic by IP flags everything. The DNS query that precedes the connection is different: it names the service a user actually asked for.

"DNS proves intent. IP only proves a packet reached shared infrastructure."

IP-based detection

Keys on destination IP ranges. Because providers share cloud infrastructure with general services, it produces false-positive rates above 96% — noise that can't support a compliance claim.

DNS-only detection

Keys on the resolved hostname. Each detection is evidence that a user or app intended to reach a specific AI service — an artifact you can defend in an audit.

What it does

A full governance picture, from one passive sensor.

AI detection

Identifies confirmed AI service access through DNS hostname resolution, with optional SNI correlation.

DLP scanning

Flags potential data-loss events in monitored traffic against patterns you define.

Unit attribution

Maps activity to departments or units via VLAN mapping and Active Directory.

Web dashboard

Executive, operational, and historical views with filters and CSV export.

Monthly reports

Audience-specific DOCX reports for IT, Legal/Compliance, Records, and Executive readers.

MDR / SIEM feed

Optional syslog integration with severity-based filtering for tools like Arctic Wolf.

Who it's for

Visibility for the organizations priced out of it.

Public agencies and non-profits carry real obligations to know what AI they run — under frameworks like the NIST AI RMF and, for public agencies, laws such as Texas's TRAIGA. Most can't afford enterprise tooling to meet them.

~19,500

U.S. municipal governments

1M+

U.S. non-profit organizations

What it replaces

$50K–$200K+/yr

typical SASE / CASB cost

AIGuard T1 runs on a single repurposed workstation, carries no licensing cost, and is configurable by an IT generalist without writing code.

AIGuard reports confirmed AI access — not a complete inventory. It says so plainly.

Encrypted DNS, browser-embedded AI, and on-device models can leave no network signature. AIGuard is one tier of a layered approach, and an inventory that acknowledges its own limits is the only kind that corresponds to reality.