Understanding the Unsanctioned View
Selecting Unsanctioned narrows the AI Landscape tab to shadow AI: the applications discovered in your traffic that you have not approved.
Everything else is removed from the page. Only the Unsanctioned AI Apps table remains.
Use this view when your task is discovery, finding out what your people are using without approval, judging how risky it is, and deciding what to do about it.
To open it, go to AI Security › Dashboard, then click Unsanctioned in the filter bar.
What the view contains
| Section | Shown in this view |
|---|---|
| Sanctioned AI Apps | No, removed |
| MCP Gateway Connections | No, removed |
| Unsanctioned AI Apps | Yes |
| Identity Landscape | No, removed |
The filter bar also changes. The App list disappears, leaving only the time period and the All, Sanctioned and Unsanctioned buttons.
Reading the table
| Column | What it shows |
|---|---|
| AI Application | The name of the discovered application |
| Risk | The risk level assigned to it, for example Medium or Low |
| Category | What kind of AI application it is, for example AI Meeting and Transcription, or AI Code and Development |
| Active Users | How many people used it during the selected period |
| Activity Mix | How the traffic splits between Visits, Uploads, and Downloads, matching the legend above the table |
| Total | The total activity count |
The table is sorted by Total, highest first, so the most-used applications appear at the top. Use Rows per page and the page arrows to work through the full list.
What to look for
Uploads are the column that matters most. A visit means someone opened the application. An upload means data went into it. An application with a low total but a high upload share can be a greater exposure than a heavily visited one where nothing is sent.
Category tells you what the application is for, which is often enough to judge whether the usage is reasonable. A transcription tool being used by one person is a different conversation from a code assistant being used by a team.
Active Users tells you how widespread it is. A single user may need a conversation; a dozen suggests a gap in what you have approved.
What you can do from here
- See every unapproved AI application discovered in the period
- Judge which ones carry the most risk
- Identify which are receiving uploads rather than just visits
- See how many people are using each one
- Return to the full page by clicking All, or switch to approved AI by clicking Sanctioned