How to use 3aiSeal

3aiSeal watches outbound network traffic for AI use, classifies it against your approved baseline, and maps findings to security-control frameworks. Two ways to run it:

Enterprise: govern AI use across a fleet

1. Deploy the agents. Install the 3aiSeal agent on each machine (see the deploy scripts for macOS and Windows). Agents watch outbound connections and report what they see to this console.

2. Set your baseline of approved AI (your known profile). In Settings, mark which AI tools and vendors are sanctioned. That approved list is the profile everything is measured against; anything off it is flagged.

3. Check the traffic. The Events view lists every AI connection detected, with the machine, process, vendor, destination, severity, and a computed posture.

4. Analyze. Use the posture filter and the machine, category, and search filters to triage. Shadow = an unapproved AI tool. Anomalous = an approved tool reached by an unexpected process (often an embedded or ad-hoc integration). Unknown = an endpoint no policy classifies. Sanctioned = within your baseline.

5. Link to the frameworks. Each finding maps to NIST SP 800-53, NIST AI RMF, MITRE ATLAS, and the OWASP LLM Top 10. The mapping is served at /api/frameworks and on each event, so you can turn a finding into control evidence. (A Frameworks view in the console is on the roadmap.)

6. Route and alert. Configure phone push and the ServiceNow integration so findings reach your queue as alerts or tickets.

Standard: see what your own device is doing with AI

For an individual or small team who want to know what their own machines are sending to AI services, and be alerted.

1. Install the agent on your computer. It watches which apps and processes reach AI services.

2. See your AI footprint. The console shows which tools on your device are talking to AI, and whether each is approved.

3. Get alerted. Turn on phone push to be notified when an app starts using an unapproved AI service.

Note: the current agent covers macOS and Windows. On-device scanning for phones (iOS and Android) is on the roadmap, not yet available.

Postures at a glance

sanctioned - approved AI use, within your baseline.
shadow - an AI tool that is not on your approved list.
anomalous - an approved tool reached by an unexpected process.
unknown - a destination not yet classified.

3aiSeal is a detection and evidence tool. It alerts and records; it does not block traffic.