ASAI Security ResearchIndependent public-source research
Public reviewread only

Solution approach

Business-application configuration security

Find embedded AI features and risky identity, connection, or security settings in business applications.

Use-case context

How this approach relates to the selected use case

Governance and risk: Additional if: Governance includes AI inside business apps — AI features and approved AI activity inside business applications must be inventoried for governance.

Back to use case →
Research scopeVendorsPublicly documented vendor profiles
Evaluation guideRequirementsRequirements connected to the selected use case
Evidence basisSourcesPublic claims linked to their original sources
Unresolved itemsQuestionsMissing support is labeled instead of assumed
View research coverageThese counts describe available public research, not product quality or suitability.Expand
Vendor profiles
5 shown in this view
Security requirements
2 to review
Strong public support
8 requirement records
Limited public support
2 requirement records
Open research
0 with no supporting claim · 0 incomplete

Evaluation guide

What to verify for this use case

Foundational security requirement

AI-feature discovery in business applications

Inventory software as a service (SaaS) applications that embed AI features, expose enterprise data to AI capabilities, or create AI-driven data movement.

Questions to test
  1. A software as a service (SaaS) app with an embedded AI feature appears in the software as a service (SaaS) AI inventory with app, provider, and feature context.
  2. The inventory shows which users, data classes, integrations, or providers are associated with the AI-enabled software as a service (SaaS) app.
  3. Third-party AI service use is flagged separately from generic software as a service (SaaS) application discovery.
Related frameworks

NIST AI RMF Playbook · NIST Cybersecurity Framework 2.0 · CIS Critical Security Controls · ISO/IEC 42001 · OWASP GenAI Security Solutions Landscape

Foundational security requirement

Approved AI usage monitoring

Monitor approved AI workspaces, tenants, gateways, and model platforms such as ChatGPT Enterprise, Claude Enterprise, Gemini, Microsoft Copilot, Vertex AI, Elvex, or internal AI gateways.

Questions to test
  1. Approved AI workspace activity appears with user, workspace or tenant, model or provider, and timestamp.
  2. Prompt, model, or admin activity can be exported or correlated for the selected approved AI platform.
  3. Model or provider usage can be filtered for the scoped workspace, tenant, gateway, or platform.
Related frameworks

NIST AI RMF Playbook · NIST Cybersecurity Framework 2.0 · CIS Critical Security Controls · ISO/IEC 42001 · OWASP GenAI Security Solutions Landscape

Vendor research

Vendors with public research for this approach

Choose vendors to compare →

Only requirements explicitly connected to the selected use case are shown. Vendors are grouped by whether this approach is a core product focus or related coverage, then ordered by documented support across the requirements shown. This organizes public research coverage; it is not a product ranking or recommendation.

Evidence labelsStrong public supportLimited public supportNo supporting claim foundResearch incomplete
VendorBusiness-app AI inventoryApproved AI activitySourcesAction
Core product focusThis approach is central to how these vendors present the product · 3 vendors
Obsidian AI SecurityGrowth stageSupport found for 2 of 2 requirementsStrong public supportStrong public support2Profile →
RecoGrowth stageSupport found for 2 of 2 requirementsStrong public supportStrong public support2Profile →
Grip SecurityGrowth stageSupport found for 2 of 2 requirementsStrong public supportLimited public support2Profile →
Related coverageThese vendors address the requirements through another core product focus · 2 vendors
Veeam / Securiti AIEstablishedSupport found for 2 of 2 requirementsStrong public supportStrong public support1Profile →
CrowdStrike AI SecurityEstablishedSupport found for 2 of 2 requirementsStrong public supportLimited public support2Profile →

Company maturity remains a filter and profile attribute; it does not affect the research-coverage order.