Portnox detects and removes unauthorized AI applications from managed devices

Portnox has announced new capabilities to detect unauthorized AI applications and agents on managed devices and automatically enforce security policy, restricting, quarantining, or removing unapproved or risky applications the moment they’re detected.

The capability addresses shadow AI: generative AI applications that increasingly act as autonomous agents, reaching local files, remote resources, and enterprise data with the same permissions as the logged-in user. As this footprint grows faster than most organizations can track, Portnox gives IT and security teams the visibility and automatic control needed to close the gap.

Portnox now allows security and IT teams to define which generative AI applications are permitted or prohibited, then automatically assess and score device risk based on what’s installed. Portnox can detect leading generative AI applications, including ChatGPT, Microsoft Copilot, Claude, Google Gemini, Perplexity, DeepSeek, Cursor, Codex, and Ollama, along with dozens of other AI assistants, coding agents, local models, and image-generation tools, with coverage expanding continuously as new AI agents and tools emerge. When a device violates policy, Portnox can automatically trigger enforcement or remediation based on the organization’s existing access rules.

“AI is simply moving too quickly for security teams to manage it through visibility alone,” said Denny LeCompte, CEO of Portnox. “Organizations need to know which AI tools are inside their environment and set policies about which ones they trust and enforce those decisions automatically in real time. As AI becomes more autonomous, control over access becomes every bit as important as the technology itself.”

From shadow AI to automatic enforcement

Autonomous agents and other AI applications continue to show up on managed devices with little warning. Employees install AI assistants, coding tools, and local models directly, without going through centralized procurement or approval, leaving security teams with limited visibility into what’s running or what access it has.

Rather than requiring a separate security process for generative AI, Portnox extends its existing posture detection and access controls to this new class of applications, giving IT teams the same policy-based control over Shadow AI that they already apply elsewhere.

Detection is only useful if it leads to action. Once Portnox identifies an application that falls outside an organization’s policy, whether it’s explicitly prohibited or simply unapproved, it can respond immediately, without waiting on a security team to catch it manually.

Depending on the severity of the risk, that might mean blocking the device from the network, restricting its access to specific resources, or removing the application entirely, on both macOS and Windows. IT and security teams set the rules once, and Portnox handles enforcement continuously and automatically from there.

Keeping control as AI moves faster

The new capability builds on Portnox’s recently announced AI agent security capabilities, which give organizations a network-level “kill switch” to immediately restrict or revoke access when an AI agent or other identity becomes risky. The two capabilities address AI risk at different points in the security lifecycle: identifying and controlling unapproved AI applications on endpoints, while continuously evaluating and restricting access when an AI agent already operating in the environment becomes risky.

“As AI tools become more capable and more deeply embedded in the enterprise, security teams need to maintain control over where they operate and what they can access,” added LeCompte. “That requires visibility, clear access boundaries, and the ability to intervene automatically when something falls outside policy. Policy doesn’t mean anything if you can’t enforce it.”