Endpoint Compliance & Shadow AI
A lightweight device agent that proves your endpoints are compliant, inventories the software your team runs, and surfaces the AI tools most programs never see.
Many controls, disk encryption, screen lock, OS patching, are only real if they hold on the laptops your team actually uses. Aegis includes an endpoint layer so those controls produce evidence automatically, and so you can see the software, and the AI, running across your fleet.
The device agent
A lightweight agent installed on employee devices reports the posture an auditor asks about, so device compliance is evidenced continuously instead of by a manual spot-check. Until an agent is installed, Aegis says so plainly, the Devices view tells you there is no device data yet rather than implying everything is fine.
Once devices are enrolled, endpoint posture becomes another live evidence source feeding the controls that depend on it.
What the agent checks
Every device runs four checks, on macOS, Windows and Linux:
| Check | macOS | Windows |
|---|---|---|
| Disk encryption | FileVault reports On. FileVault that is scheduled to turn on at the next login does not pass yet, because the disk is not encrypted until it does | BitLocker protects the system drive. On a machine where BitLocker is not available, the check is recorded as not applicable, with the exception noted |
| Screen lock (5 minutes or less) | The screen locks, and asks for a password, within 5 minutes of inactivity | The screen saver or display turns off within 5 minutes and a password is required on resume |
| Password policy (8 characters or more) | A minimum password length of 8 or more is enforced, by the local policy or an MDM passcode profile, and automatic login is off | A minimum password length of 8 or more is enforced by the account policy |
| Antivirus | XProtect is present and Gatekeeper is on, or a known antivirus product is running | Windows Security Center reports an active antivirus, or Microsoft Defender is on with real-time protection |
On Windows, the device also reports its Windows Hello PIN length for information. It does not change the result of any check.
The password check confirms that a policy is enforced, not the length of a password someone set before the policy existed. An older, shorter password can remain until it is changed, unless your MDM forces a reset. If the agent cannot read a policy at all, the check fails rather than assuming one exists.
Software inventory
The agent builds an inventory of the software installed across your fleet. This gives you:
- A single view of what your team runs, synced from devices rather than surveyed.
- A review workflow, classify applications, with new apps defaulting to an unreviewed state so nothing slips in unnoticed.
- A cross-fleet search, find every device running a given application, invaluable when a new CVE drops and you need to know your exposure in minutes.
Shadow AI
This is where Aegis goes somewhere most compliance tools do not. From the same inventory, Aegis surfaces Shadow AI, the AI tools discovered on employee devices, and lets you govern them.
Each discovered AI tool can be classified as:
- Sanctioned — approved for use.
- Unsanctioned — not approved; a conversation to have.
- Prohibited — not allowed, and now visible if it appears.
AI governance frameworks, ISO 42001, the NIST AI RMF, the EU AI Act, increasingly expect you to know which AI systems are in use across your organization. Shadow AI turns that expectation from an unanswerable question into a reviewable list.
Why it matters to a CISO
Endpoint and AI visibility usually require a separate MDM and a separate AI-governance effort. Folding the basics into Aegis means:
- Device controls evidence themselves, no quarterly screenshot drive.
- You can answer "what are we running?", across both conventional software and AI, from one place.
- AI governance has a starting point, an inventory you can classify and act on, which is the first thing every AI framework asks for.
Next steps
Integrations & Cloud Tests
The other half of continuous evidence.
Team & Access
Manage the people whose devices these are.
Frameworks
The AI frameworks Shadow AI helps you meet.
Capabilities
The full feature reference.
Contact us
- Website: nexusvoidai.com
- LinkedIn: linkedin.com/company/nexusvoidai
- Email: ujwal@nexusvoidai.com