Visibility overview

Visibility answers the question an SDK can’t: what AI is actually in use across the company? SDK instrumentation sees the applications you chose to instrument. The Shield360 endpoint collector sees everything else: coding agents on developer laptops, AI desktop apps, AI websites, and scripts calling a provider directly with a key nobody registered.

Deploy the collector

One command per machine, or push it with your MDM.

Collection policy

Choose what is collected beyond AI usage: browsing, network, key fingerprints.

AI spend report

What you pay for AI, attributed to people, machines, projects and models.

Shadow AI

AI in use that nobody is paying for or tracking centrally.

How it works

flowchart LR
  subgraph Machine["Each macOS, Windows or Linux machine"]
    F["Files AI tools already write<br/>(Claude Code, Codex, Cursor)"]
    A["Foreground application<br/>and machine state"]
    B["Browser history<br/>(if policy allows)"]
    N["OS socket tables<br/>(if policy allows)"]
    C["shield360 collector"]
    F --> C
    A --> C
    B --> C
    N --> C
  end
  C -- "HTTPS, per-machine token" --> P["Shield360 platform<br/>/api/collector/device/events"]
  P --> T[("ClickHouse<br/>shield360_collector_* tables")]
  T --> V["Visibility, Costs,<br/>Shadow AI"]

The collector reads: files that AI tools already write to disk, which application is in front, and, only when your policy allows it, browser history and the operating system’s own socket tables. It sends what it found to your Shield360 platform over HTTPS.

The collector is deliberately incapable of affecting traffic:

• It installs no certificate.
• It changes no proxy setting.
• It opens no listening socket.
• It is never in the path of a request, so a connection can’t fail because Shield360 observed it.

What you see

Area	What it shows
Visibility → Overview	AI usage over the selected window: tokens, responses, lines of code written, time in AI apps and AI websites, broken down by person, machine, project, model and tool.
Visibility → Fleet	Every enrolled machine: its user, OS, collector version, last report and status. See Fleet.
Visibility → Setup	The organisation’s install key, one-line install commands, CLI downloads for every platform, and the collection policy.
Costs → Analytics	The AI spend report: billed cost against API-rate cost, subscriptions, coverage and shadow AI.

What the collector reports

Signal	Source	Needs policy?
AI usage (tokens, model, tool, project, plan)	Claude Code, Codex and Cursor files on disk	No
Lines added and removed per coding session	Claude Code and Cursor session files	No
Time per application, AI desktop apps included	Foreground application sampling	No
Machine state (active, locked, away)	OS session state	No
Browsing: AI site visits	Browser history	Yes: domains or full
Non-browser processes talking to AI providers	OS socket tables	Yes: network observation
Which API key a process used (masked hint only)	Process environment	Yes: key fingerprints

The full list of events and fields is in the data reference.

Tenancy

Every machine enrols into one tenant, which is the database config its install key belongs to. Every shield360_collector_* table carries database_config_id as the leading sort key, and the platform stamps it from the machine’s authenticated token. The machine never supplies it. A query that doesn’t filter on the tenant is refused, not run unscoped.