Hello, everyone, in this session, we'll take a look at application discovery, sometimes also referred to as AI access, which is a capability delivered through the integration of Cisco AI Defense and Cisco Secure Access. We'll discuss how organizations can gain visibility into AI.00:04Application usage.00:20Discover shadow AI and apply security guardrails to protect sensitive data while still enabling AI adoption. We'll start with a quick introduction to Cisco Secure Access and its role in this architecture. We'll then review the prerequisites for enabling application discovery, walk through the integration process between secure access and AI defense.00:21Discuss AI guardrails and DLP policies and finally look at application discovery itself together with several operational best practices.00:41Before we discuss the integration itself, it's important to understand the role of Cisco Secure Access. Secure Access is Cisco's cloud delivered security service edge platform built around zero trust principles. It provides secure access to internet resources, SaaS applications.00:51In private applications while consolidating multiple security functions into a single management platform. For our use case, secure access is the traffic enforcement and inspection layer that makes AI application visibility possible. The integration works because each platform has a very clear responsibility.01:06Secure Access is responsible for traffic inspection, HTTPS decryption, DLP enforcement, user identification and policy enforcement. AI defense focuses on AI specific visibility and governance capabilities such as application discovery, AI analytics, and AI specific security controls. The traffic flow is straightforward.01:25Users access AI applications through secure access. Secure Access performs inspection and enforcement, and AI defense receives telemetry and analytics information to provide visibility and governance. Before application discovery can function, several prerequisites must be met.01:45On the secure access side, we need an active tenant administrative access, HTTPS inspection capabilities and data loss prevention enabled. On the AI defense side, we need an active AI defense tenant and administrative access. Additionally, should secure access and AI defense for some reason not be managed under SCC? An API key with.02:03Reports app discovery is required.02:23Let's start by generating API key in secure access. Navigate to administration, management and API keys, and create a new API key. The key scope must be configured as report/app discovery with both read and write permissions enabled. This API key is later used by AI defense to securely retrieve application discovery information.02:26From secure access. Next, move to the AI defense portal. Under administration and integrations, select secure access and choose Connect. Paste the API key that was generated in secure access and save the configuration. Once this step is completed, communication between both platforms is established.02:46There is also an easier integration option available. Again, if both Cisco AI Defense and Cisco Secure Access are managed through Cisco Security Cloud control, there is NO need to generate an API key in Secure Access. Instead, an additional connect automatically option appears in the AI defense integration screen.03:08Simply enable the toggle, click connect, and the integration is established automatically. At this point, the integration exists, but application discovery still won't display any information. Cisco documentation requires at least one AI guardrails rule to be configured within secure access DLP policies. HTTP.03:26This inspection is equally important because secure access must be able to inspect prompts, responses, and file uploads exchanged with AI applications.03:46The 1st step in creating an AI guardrails rule is defining the general settings such as the rule name and severity level. The selected severity later appears in AI defense as the risk level associated with detected violations. Next we define which data classifications should be protected.03:56Organizations can use Cisco's built in classifications or create their own custom definitions. Common examples include personally identifiable information, financial data, source code, and intellectual property. AI guardrails can also inspect uploaded files.04:14Policies maybe based on file types, file sizes and document labels, ensuring sensitive information is protected whether it is typed into a prompt or uploaded as a file. The next step is selecting the users or groups the policy applies to.04:30This enables organizations to enforce stricter controls for privileged users while applying more permissive policies elsewhere. Here we define which AI applications the rule applies to. Organizations may choose to protect all AI applications or only specific services such as chat GPT.04:45Gemini or Microsoft copilot. The next step is selecting the enforcement action. Organizations can monitor or block activity entirely. Most customers begin with monitoring and gradually increase enforcement as they gain confidence in the policies.05:03Secure access also supports user and administrator notifications. Users can receive browser pop UPS explaining why an action was blocked while administrators can receive email alerts for policy violations. These features improve transparency and simplify policy adoption.05:21Once the integration and AI guardrails are active, application discovery begins collecting information about AI application usage. The dashboard 1st displays the application name together with its subcategory. Application discovery also provides visibility into the type of content exchange with AI applications. This helps organizations.05:38Better understand how AI services are being used across the environment.05:58The risk status shown in AI defense reflects the severity of AI guardrails violations detected by secure access. Higher severity events naturally result in higher risk visibility. AI defense provides information about the number of users interacting with each AI application together with DNS request statistics.06:03This helps identify both adoption trends and unusual usage patterns. The total web traffic metric shows the amount of data exchange with a specific AI application. Negative values represent outbound traffic while positive values represent inbound responses.06:23The 1st detected time stamp shows when secure access initially observed usage of an application. This is particularly useful for identifying newly introduced shadow AI services. Vendor information identifies the organization's operating the AI services used by employees. This support.06:41Both application approval and risk assessment processes.06:59The scannable field indicates whether secure access can inspect traffic associated with a particular application. Some applications use protocols or encryption methods that limit inspection capabilities. The last detected time stamp shows when the application was most recently observed.07:04Combined with 1st detected information, it helps track adoption trends over time. Firewall events show the number of layer seven firewall events associated with an application. This provides useful context during investigations and threat hunting activities.07:21Applications can be categorized as approved, under audit or not approved. This simplifies governance and provides clear guidance for both users and administrators. This is where the real value of application discovery becomes visible. Organizations can identify approved enterprise AI applications, consumer AI tools and.07:38Completely unknown AI services, security teams can then decide whether these applications should be allowed, monitored or blocked. The goal is not to stop AI adoption, but to enable it safely. There are several best practices we recommend during deployments. Start with visibility before enforcement to understand existing usage patterns.07:58Classify applications based on business risk and importance, build DLP policies around sensitive data rather than individual applications. Always enable HTTPS inspection to ensure full visibility. Finally, adopt a phased approach moving from monitoring to warnings and eventually to blocking where appropriate.08:18Secure access provides the enforcement layer. AI defense provides visibility, analytics, and governance. Application discovery enables organizations to identify shadow AI usage. AI guardrails protect sensitive information during interactions with AI applications.08:38Together, these technologies allow organizations to embrace AI innovation while maintaining strong security controls. Thank you for your time.08:54
