AI Visibility Map

Northbridge Corp: on-premises, cloud and SaaS | What AI is running in your environment, and which tool can actually see it

Prepared by

Date

Version

SCOPE Approved AI SaaS: Microsoft 365 Copilot, 200-seat pilot, the only sanctioned AI service. All other AI services, including AI features inside already-licensed products, are unsanctioned by policy. Estate: about 2,400 endpoints, 180 servers, a small Azure footprint, a recently acquired subsidiary on its own network, a customer-facing portal and a Microsoft 365 tenant.

How to use: Each cell asks one question: which tool tells you this AI asset exists here, and what it is doing? Name the tool, then set coverage. Empty or None cells are your blind spots. Sanctioned versus shadow is the column axis: SaaS - Internal is the AI you license and approved, SaaS - External / Shadow is everything reached over the network. The governance band at the foot asks whether any of it is approved, audited and enforceable.

AI asset classwhat you are looking for

On-premisesWorkstations and servers, including OT or industrial segments: managed and unmanaged endpoints, VDI, on-prem VMs, containers, engineering workstations, DMZ

Cloud platformsAzure, AWS, Google Cloud: IaaS, PaaS and managed AI services

SaaS - Internal (in-tenant)AI inside apps you license, for example Microsoft 365 Copilot and in-tenant agents. Your sanctioned AI SaaS usually lives here

SaaS - External / Shadow (egress)Third-party AI reached over the network. Unsanctioned unless your policy approves it

Models and model endpoints

Which models run or are called, by whom, and with what data?

Workstations: local runtimes (Ollama, LM Studio, llama.cpp), model weight files on disk, listeners on :11434 / :1234, sustained GPU use. Engineering workstations on OT or industrial segments are a common blind spot. Servers: self-hosted inference (vLLM, Triton, TGI), model registries, GPU nodes, internal model API endpoints, including dev servers calling AI APIs.

Defender for Endpoint + Defender for Servers: local runtimes and self-hosted inference via software inventory and advanced hunting. Endpoints in the acquired subsidiary are NOT onboarded.

Managed model deployments (Azure OpenAI, AWS Bedrock, Vertex AI), including AI services stood up in unsanctioned subscriptions or accounts; model catalogue use; endpoint keys; quota and spend as a discovery signal.

Microsoft Defender for Cloud + Azure Policy: Azure OpenAI deployments and model endpoints in the control plane

Models embedded in the SaaS you license (the copilot's grounding model, vendor sub-processor models); model version, hosting region, tenant data boundary.

Microsoft contract, DPA and sub-processor list: documentation, not telemetry. No tool reports model version, hosting region or tenant data boundary.

Outbound calls to model APIs (api.openai.com, api.anthropic.com, generativelanguage.googleapis.com); API keys held or funded outside central management.

Palo Alto NGFW + URL Filtering: egress to known model API domains, by category

Agents and copilots

What acts on its own, under whose identity, with what permissions?

Workstations: desktop and coding agents (CLI / IDE), browser-driving agents, scheduled agent jobs (cron, Task Scheduler). Servers: agent runtimes and orchestrators (LangGraph, n8n, AutoGen), daemons and containers, service accounts running agent workloads.

Defender for Endpoint + Defender for Servers: agent processes and binaries; no view of agent identity, permissions or what the agent connects to

Cloud agent services (Azure AI Foundry, Bedrock Agents, Vertex AI Agent Builder); agent non-human and workload identities; roles assumed and actions written to cloud audit logs.

Microsoft Defender for Cloud + Entra workload identities: Foundry agent services and the roles they assume

Copilots and agent builders in your suite (for example Microsoft 365 Copilot and Copilot Studio), including maker-built agents and flows published by end users; who published each one, and what knowledge and connectors it holds.

Microsoft 365 admin centre + Power Platform admin: Copilot and Copilot Studio agents, including maker-built

Third-party agent platforms reached over the web; browser agents acting on corporate sessions; OAuth grants letting an external agent act inside your tenant.

MCP servers and tool connectors

What can an AI reach into, and who approved that connection?

Workstations: local stdio MCP processes, .mcp.json and client config files, MCP containers, IDE extensions that add connectors. Servers: self-hosted remote MCP endpoints (HTTP / SSE), container images, exposed ports, credentials stored in server-side MCP config.

?Defender advanced hunting: no MCP-aware detection exists out of the box; this would need custom KQL that nobody has written yet

Hosted MCP services; API gateway routes in front of MCP; secrets issued to MCP clients; consented enterprise applications.

Microsoft Defender for Cloud: hosted services and exposed ports only; no MCP-level detail

Vendor-supplied MCP connectors inside licensed SaaS; platform connectors (for example Graph or Power Platform) exposed to copilots; scope grants that widen what an agent can read.

Power Platform connector inventory: connectors exposed to Copilot and their scope grants

Desktop and IDE clients connecting to remote MCP endpoints on the internet; egress to MCP / SSE endpoints; tokens issued to external MCP servers.

?Palo Alto NGFW: egress to remote MCP / SSE endpoints is not a URL-filtering category; traffic is allowed and uncategorised

AI pipelines and data flows

Where does your data go to be embedded, trained on, or retrieved?

Workstations: notebooks, local RAG indexes, local vector stores, bulk data pulled down for embedding. Servers: ETL into vector databases, fine-tune jobs, feature stores. Exports from OT or industrial data stores staged for analytics are often the highest-value data at risk.

ML pipelines (Azure ML, SageMaker, Vertex AI); managed vector stores; training data in object storage; cross-region data movement.

Microsoft Defender for Cloud: Azure ML pipelines, managed vector stores and training data exposure

Copilot and vendor RAG indexing your documents, mail and ticket data; semantic index scope; retention and data-residency terms.

Microsoft Purview: what Copilot is grounded on; DLP and sensitivity labels on SharePoint and OneDrive

Corporate data pasted or uploaded to external AI sites; file uploads to AI services; whether prompts and documents are used for vendor model training.

Palo Alto NGFW + URL Filtering: destination and upload volume only. No content inspection, so nobody can say WHAT data left.

AI tooling, runtimes and supply chain

What AI code and dependencies are installed, and can you trust them?

Workstations: pip / npm AI packages, IDE and browser AI extensions, desktop AI apps installed outside the software catalogue, CUDA and driver stack. Servers: container base images carrying AI libraries, SBOM coverage, CVEs in AI / ML dependencies, hard-coded API keys, models pulled from public hubs.

Defender for Endpoint + TVM / Defender for Servers + TVM: AI packages, IDE and browser extensions, CVEs in AI libraries

Managed notebook images; marketplace images; IaC (Terraform, Bicep, CloudFormation) declaring AI services; CI/CD steps calling models.

Microsoft Defender for Cloud: container image and IaC scanning

AI features silently enabled inside licensed SaaS; vendor change notices that turn AI on by default; sub-processor list and contractual AI terms.

Unvetted AI plugins and marketplace installs; model and package pulls from public hubs; extensions and desktop apps that call external AI at runtime.

Palo Alto NGFW + URL Filtering: egress generated by extensions and marketplace installs at runtime

GOV

Governance and assurance

For whatever runs here: is it approved, is it audited, and can you enforce policy?

Workstations: approved-software catalogue for AI tools, SSO session activity, version and patch state of approved AI clients. Servers: server-side integrations and webhooks to approved AI services, service principals used by automation, key custody.

Intune approved-software catalogue: AI clients on managed devices only; unmanaged and BYOD are out of scope

Subscription or account policy and entitlements; private endpoints; enterprise policy and content-filter configuration.

Azure Policy + Entra app registrations: subscription guardrails and consented enterprise applications

Approved-app register; copilot and agent audit logs shipped to the SIEM; DLP and sensitivity-label enforcement on AI surfaces; licence and seat inventory.

Microsoft 365 admin centre + Purview audit, shipped to Microsoft Sentinel: approved-app register and Copilot interaction audit

Unless your policy approves it, nothing here is sanctioned, so can you detect and enforce? Tenant restrictions and SSO enforcement; free-tier signups with corporate email; personal AI accounts on corporate devices.

Coverage: Full: discovered, monitored, and the logs land in the siem Partial: some assets or some signal only None: confirmed blind spot Unknown: not assessed yet, or the tool is unverified

Every cell scored Full, Partial or None must name the tool that provides it. A score with no tool is not coverage. Start the tool name with "?" when the tool is deployed and could cover the cell but nobody has confirmed it. Leave those cells Unknown until someone checks.
Coverage means you can discover the asset, see what it does, and keep the evidence. A tool that only blocks, with no inventory or logging, is Partial.

Blue Marshal, bluemarshal.dev | framework v0.1.0

Visibility tool register

One row per tool that gives you AI visibility today. It feeds the map on page 1.

Owner

Reviewed

Record each tool once. Map rows = the page 1 rows it covers (for example 01, 02, 05 or GOV). Depth says whether it only sees the asset, sees the behaviour, or can stop it. If a tool's logs do not reach the SIEM, its coverage is Partial no matter how good the tool is.

Tool / product	Vendor	Type of signal	Environment	Map rows covered	Depth	Logs to SIEM	Known blind spot / gap
Defender for Endpoint	Microsoft	Endpoint agent	On-premises	01, 02, 03, 05, GOV	Detect	Yes	Sees processes and binaries, not agent identity, permissions or what the agent connects to. No unmanaged or BYOD devices. Reports no GPU telemetry; per-user installs can evade software inventory.
Defender for Servers	Microsoft	Endpoint agent	On-premises	01, 02, 03, 05	Detect	Yes	Same limits as endpoint. Container and GPU host coverage is unconfirmed. Does not extend to the acquired subsidiary.
Microsoft Defender for Cloud	Microsoft	Cloud posture - CSPM / CNAPP	Cloud platforms	01, 02, 03, 04, 05, GOV	Discover	Yes	Control-plane and posture visibility. Cloud only: no on-prem, and it does not cover Microsoft 365 Copilot or Power Platform. Runtime process visibility on IaaS VMs depends on Defender for Servers being onboarded.
Palo Alto NGFW + URL Filtering	Palo Alto Networks	Network - firewall / URL filtering	SaaS - External / Shadow	01, 03, 04, 05	Detect	Yes	Destination and volume only: no content inspection, so it cannot say what data left. No user attribution without correlation to identity logs. MCP / SSE endpoints are not a filtering category. Off-network and BYOD traffic never passes through it.
Microsoft Purview	Microsoft	SaaS admin and audit API	SaaS - Internal	04, GOV	Discover	Yes	Confirm DLP and sensitivity-label enforcement actually applies on Copilot surfaces, not just in SharePoint.
Microsoft 365 + Power Platform admin centres	Microsoft	SaaS admin and audit API	SaaS - Internal	02, 03, GOV	Discover	Yes	Inventories agents and connectors but does not judge whether a maker-built agent is safe. No alerting on newly published agents.
Microsoft Sentinel	Microsoft	SIEM / log analytics	Multiple	GOV	Detect	Yes	Receives Copilot audit and Defender telemetry. No AI-specific analytics rules or workbooks are deployed: the data arrives and nothing looks at it.
Subsidiary firewall		Network - firewall / URL filtering	On-premises			No	Run by the acquired subsidiary's own IT. Its logs never reach Sentinel and nobody at Northbridge has checked whether it blocks or even sees AI traffic.
NO CASB DEPLOYED		Other	SaaS - External / Shadow	02, GOV			Listed on purpose. Northbridge has egress detection via the firewall but no CASB, so there is no app-level governance, no OAuth grant review, and no way to enforce against unsanctioned AI use.

Top blind spots to close: every empty or None cell on page 1

Decisions requested

Blue Marshal, bluemarshal.dev | framework v0.1.0