Shadow AI – Frequently Asked Questions

Question: Does Shadow AI Detection affect my existing firewall rules?

Answer: No, Only Shadow AI-scoped rules are synchronized. They are inserted above the default URLCatDefault rule.

Question: Can I use Shadow AI Detection without SecureEdge?

Answer: No. Shadow AI Detection on CGF requires SecureEdge enrolment because it relies on AI Security, a SecureEdge feature, to manage policies and reporting infrastructure.

Question: Does this work with Control Center-managed appliances?

Answer: Yes. Both standalone and CC-managed CGF appliances are supported. The CC forwards the SecureEdge configuration to managed boxes. Ensure all managed boxes run the same
firmware/hotfix level.

Question: What happens if my firmware is too old?

Answer: SecureEdge Manager will not push Shadow AI configuration to appliances running firmware older than 10.5.1. Appliances will continue to operate normally without Shadow AI detection.

Question: Is LAN client traffic visible?

Answer: Yes. DNS queries from LAN clients behind the CGF are captured and reported, not just traffic from devices running the SecureEdge Agent.

Question: What is the relationship between SecureEdge, AI Security, and Shadow AI Detection?

Answer: SecureEdge is the product. AI Security is a feature within SecureEdge that provides visibility and control over AI application usage. Shadow AI Detection is a capability within AI
Security that identifies and enforces policies against unauthorized AI-tool access. The AI Security dashboard, AI Risk Services and BarracudaONE integration are all part of
the SecureEdge AI Security feature.