A block list for AI websites looks like a five minute job. It is not. The first attempt usually catches the four names everyone knows, breaks a developer's coding assistant and a vendor's support chat widget, and leaves the leak path untouched: a browser tab on a personal phone, a DNS over HTTPS client nobody configured, and an employee who moved the conversation to a service that launched last month. This guide shows how to block ChatGPT in a way that still holds after the first week, with Gemini, Claude and Copilot covered alongside it.
This guide is written for the person who has to make the block hold: the IT lead at a 40 person firm, the security engineer at a defense subcontractor with controlled unclassified information in scope, the managed service provider inheriting an environment where nobody knows what people are using. It covers four layers in the order you should build them, states plainly what each layer cannot see, and describes how to allow the tools you decide to keep.
Why businesses are moving to block ChatGPT and other cloud AI
The instinct to block is usually triggered by one incident, but the measured picture is broader. IBM's 2025 Cost of a Data Breach work, produced with the Ponemon Institute across 600 organizations, reports that 13 percent of organizations had experienced a breach of an AI model or application, and that 8 percent did not know whether they had been compromised that way. Among the organizations that were compromised through AI, 97 percent reported that they did not have AI access controls in place. Sixty percent of those incidents led to compromised data and 31 percent to operational disruption.
The same research found that a high level of shadow AI (workers downloading or using unapproved internet based AI tools) added USD 670,000 to the global average breach cost. Sixty-three percent of the organizations studied said they had no AI governance policies in place at all.
Usage is not a fringe behavior. Netskope's 2025 Cloud and Threat Report on generative AI found that the top 25 percent of organizations use at least 13 generative AI apps and the top 1 percent at least 40. More than 99 percent of organizations enforce policies to reduce generative AI risk, 83 percent block some apps, and the top 25 percent block at least 20 apps. When DeepSeek appeared, 91 percent of organizations worldwide had users attempting to reach it, 75 percent blocked all access, 8 percent applied granular controls and 8 percent allowed it outright.
The canonical incident remains instructive because of how ordinary it was. In 2023 an engineer at Samsung uploaded sensitive internal source code to ChatGPT, and the company banned generative AI use by staff shortly afterwards, as reported by Bloomberg in May 2023. No attacker was involved. A helpful tool met a deadline pressure, and the data left.
The vendor terms are not the whole risk, but they are worth reading
A common shortcut is to assume every vendor trains on everything. The published terms say otherwise, and a policy built on a false premise gets argued down by the first employee who reads the documentation.
OpenAI states that data from the API Platform after March 1, 2023, and from ChatGPT Business, Enterprise, Edu, Healthcare and Teachers, is not used for training by default unless the customer explicitly opts in. The platform documentation shows API inputs and outputs retained for up to 30 days for service delivery and abuse monitoring, with Zero Data Retention available on some endpoints subject to eligibility, and not available on stateful endpoints such as threads and vector stores.
Microsoft states that prompts and responses, as well as data accessed through Microsoft Graph in Microsoft 365 Copilot, are not used to train foundation models. Google states that Gemini in Workspace does not use prompts or Workspace content to train generative AI models without permission. Nor does it use webpage context or responses for that purpose, and it does not share any of that with other customers. Anthropic states that training uses data a user explicitly submits as feedback or opts in to share, that it does not sell user data to third parties, and that consumer Free, Pro and Max accounts carry a setting that trains on new or resumed chats when it is on.
Those statements are the reason the argument is not really about training. It is about three other things.
The first is which agreement applies. An employee who signs up for a personal consumer account is not covered by the enterprise terms you negotiated, is not inside your tenant, is not subject to your retention policy and does not appear in your audit logs. The enterprise version of a product is not the same control as knowing which version people use.
The second is regulated data crossing your boundary. The moment controlled unclassified information or electronic protected health information is pasted into an external service, you have created a transfer you must be able to authorize and scope. Cardholder data crossing the same boundary raises the same obligation. Whatever the vendor promises about training, each of those transfers must also be logged and assessed. The OWASP Top 10 for LLM Applications lists exactly this under LLM02, Sensitive Information Disclosure.
The third is the audit trail. When an incident happens, there is one question: what left and where it went. A consumer chatbot session has no answer you control.
What does it actually take to block ChatGPT across a business?
Every control you can buy or configure sits in one of four places, and each place has a specific blind spot. Understanding the blind spots is more useful than memorizing product names, because the blind spots are what decide whether your block holds a year from now.
- DNS decides which names resolve. Blind to anything that does not ask your resolver.
- Firewall and secure web gateway decide which destinations are reachable and, with TLS inspection, which payloads are allowed. Blind to traffic that leaves through a path you do not inspect.
- Endpoint policy and application allowlisting decide which programs execute and which browser surfaces exist. Blind to a permitted browser reaching a forbidden destination.
- Identity decides who may consent to what and with which device posture. Blind to anything that needs no sign in to your tenant.
NIST's zero trust architecture guidance is the right frame for the combination. NIST SP 800-207 describes trust as never granted implicitly but continually evaluated, and places a policy enforcement point between a subject and the resource. That point enables the connection and monitors it, then terminates it when policy says so. Four layers of control are four enforcement points on the same connection, which is why they fail independently.
DNS filtering, built so it cannot be walked around
DNS is the cheapest layer and the one most blocks consist of entirely. The category you need exists in several products now. Cloudflare Gateway publishes a domain category numbered 184 named Artificial Intelligence under its Technology parent, and its policy documentation shows DNS rules written against the category selector. Cisco carries a Generative AI category through Talos reputation services, available in Umbrella and Cisco Secure Access. DNSFilter ships a Generative AI category and reported blocking more than 60 million generative AI requests in March 2025. Microsoft's Entra Internet Access web content filtering publishes an Artificial Intelligence category described as sites that use generative AI.
One finding surprises people: Microsoft Defender for Endpoint web content filtering does not have an AI category. Its published list covers adult content, high bandwidth, legal liability, leisure plus custom categories such as newly registered and parked domains, and it supports Edge, Chrome, Firefox, Brave and Opera. If your plan is "we have Defender, so we have this", check the category list before promising it. The generative AI category from Microsoft sits in Entra Internet Access, which is a different product from Defender's content filtering.
Category blocking has a second weakness that matters more than the category list: DNS filtering only works if the query reaches your resolver. Four common paths do not.
- DNS over HTTPS. Standardized as RFC 8484 in October 2018, DoH wraps a DNS query inside HTTPS to a resolver the client chose. Browsers and operating systems ship it as a default or an option.
- Encrypted Client Hello. Published as RFC 9849, ECH encrypts the TLS handshake field that carries the destination hostname, so an on path filter that inspects server name indication sees nothing to match.
- IP literals and pinned addresses. No name lookup happens, so no DNS log line exists.
- Off network devices. A laptop on a home router or a phone on cellular never touches your resolver at all.
The countermeasures are policy, not products. Block outbound DNS to anything except your own resolvers at the firewall, so a client that tries to use an outside resolver on port 53 fails. Block known DoH provider endpoints by category or by endpoint rules. Disable browser DNS over HTTPS by policy: both Chrome and Edge expose a DnsOverHttpsMode enterprise policy, and setting it to off keeps name resolution inside your resolver. On Windows, DNS client DoH behavior is configurable through Group Policy under Administrative Templates then Network then DNS Client, and Microsoft specifically warns against requiring DoH on domain joined computers, which is the right warning in the other direction too: enforce the setting you want rather than leaving it to the client's defaults.
What breaks at this layer is small and predictable. Anything that genuinely requires an external resolver, some VPN split tunnel configurations, and a handful of applications that ship hard coded DNS. The bigger breakage risk is a category vendor misclassifying a business application as the AI category, which is why you run the policy in an audit or monitor mode first and read the logs for a week before enforcing.
Firewall and secure web gateway, where the payload matters
Once traffic reaches a gateway, the question becomes what the gateway can see. Without TLS inspection, a secure web gateway sees the destination and the port. It usually also sees the server name indication from the handshake. That is enough to block a destination and not enough to distinguish an upload of a customer list from a request for a recipe.
With TLS inspection enabled, the gateway terminates and re originates the connection, so it can apply content rules to the request body. Microsoft Entra Internet Access documents TLS inspection as decrypting and inspecting encrypted traffic at service edge locations so that content filtering and access policies apply, and it documents network content policies as real time control over what users and agents share with generative AI applications. Entra also ships Prompt Injection Protection that enforces guardrails at the network level for enterprise generative AI applications. Zscaler offers an AI and ML applications rule type in Cloud App Control. You scope that rule by device, by device group, by device trust level, by user agent and by user risk profile.
Payload visibility also makes an important audit capability possible. Cloudflare Gateway's DLP documentation describes capturing generative AI prompt content (the user prompt and the model response) for allow or block HTTP policies that target a specific AI application through granular controls, with the captured content encrypted under a customer supplied public key.
TLS inspection has a real cost that vendors understate: you must deploy and trust an inspection certificate on every endpoint. That includes the unmanaged and mobile ones. Any application that pins certificates will fail until it is excepted. Microsoft's own procedure includes verifying the certificate presented in the browser, which is precisely the behavior a user would call suspicious if it appeared without notice. Announce it before you turn it on.
This layer is also where an allowlist is easiest to express. A rule ordered above the block that permits a specific application, or a specific tenant, or a specific destination, with its own logging, is cleaner than a category exception list that grows silently.
Endpoint controls and application allowlisting
Blocking at the endpoint handles the cases the network cannot, because a laptop follows the user. Application allowlisting, the practice CIS Critical Security Controls v8.1 puts in Safeguard 2.5 as using technical controls so that only authorized software can execute or be accessed, is the strongest form of this and the one most often skipped in small environments. NIST SP 800-53 CM-7, Least Functionality, is the same idea from the control catalog side.
On Windows, AppLocker enforces rules by Publisher, Path and File hash, and Microsoft recommends the publisher condition because a signature survives an application update or a move to a different folder. AppLocker covers packaged apps, executables, and Windows Installer files. It also covers scripts and DLLs. Its edition requirements have changed over time: before Windows 10 version 2004, policy deployed by Group Policy worked only on Enterprise and Server editions, while MDM deployment worked on all editions. App Control for Business, usually called WDAC, is the stronger sibling and controls drivers as well as applications. Its managed installer option trusts binaries laid down by an approved installer such as the Intune management extension, and Intune manages policies through the ApplicationControl configuration service provider.
Other platforms have equivalents. Google's open source Santa provides binary authorization and monitoring on macOS as a system extension and daemon, distributed by MDM. On RHEL, fapolicyd allows only trusted applications, including those listed in the RPM database and an explicit allow list, and Red Hat ships an Ansible system role to configure it.
Allowlisting closes the local client hole: the downloaded desktop AI helper, the portable executable, the unsigned utility a contractor emailed. It does not close the browser hole at all, because Chrome and Edge are approved applications. For the browser you need browser policy, which is a different set of switches:
- Chrome's enterprise policy documentation describes an extension install blocklist that accepts a wildcard, in which case all extensions are blocked by default and already installed extensions are disabled with no way for the user to re enable them.
- Microsoft documents that as of Edge version 141 the Microsoft365CopilotChatIconEnabled policy is the only means of controlling the Copilot icon in the toolbar, while HubsSidebarEnabled disables the Edge sidebar and blocks Copilot Chat within it, and EdgeEntraCopilotPageContext controls whether Copilot Chat can use page or PDF content for Entra signed profiles.
- Windows 11 Copilot itself is controlled by the WindowsAI policy configuration service provider setting TurnOffWindowsCopilot, available at user scope on Pro, Enterprise, Education and IoT Enterprise editions, with documented minimum builds for Windows 10 and 11.
The endpoint layer is also where you handle the case people forget: developer tools. GitHub publishes a Copilot allowlist reference for firewalls and proxies, and recommends reading its meta endpoint to discover the domains a restricted network needs, which is the correct pattern for any sanctioned AI assistant. Microsoft publishes the Microsoft 365 and Copilot endpoint requirements alongside the worldwide Microsoft 365 URL and IP ranges. Build the allowlist from vendor documentation rather than from a user's screenshot of a broken error page.
Microsoft 365, Entra and the identity side of the same problem
A surprising amount of AI exposure is an identity problem wearing a network costume. Users grant OAuth permissions to applications. That includes AI applications and extensions. The grant persists after the tab closes. Microsoft documents consent phishing as the abuse of that mechanism and pairs it with app governance as the control.
The practical settings are well documented. In Entra ID you can restrict or disable user consent to applications, and enable the admin consent workflow so that users can request approval for an application they are not allowed to consent to themselves. You can block sign ins from unknown or unsupported device platforms with Conditional Access, and Microsoft explicitly warns that the device platform condition is evaluated from the user agent string, so it must be paired with a device compliance or app protection policy to reduce the risk of a spoofed agent.
For discovery and enforcement, Microsoft Defender for Cloud Apps carries a cloud app catalog of over 31,000 discoverable apps scored on more than 90 risk factors, with a Generative AI category. Apps are tagged Sanctioned, Monitored or Unsanctioned. When the tenant also uses Defender for Endpoint, an app marked unsanctioned is blocked automatically through Defender for Endpoint network protection, and Microsoft documents the same behavior with Zscaler NSS, iboss, Corrata, Menlo and Open Systems. Without one of those integrations, Defender for Cloud Apps exports a block script for your existing appliances. That is a genuinely useful bridge, and it is also the clearest illustration of why the layers have to be wired together: the tag is a decision, the enforcement lives somewhere else.
For the data rather than the destination, Microsoft Purview Data Security Posture Management for AI ships pre built policies, including a DLP policy that blocks sensitive information from being submitted to AI apps in Edge and one that blocks elevated risk users from submitting prompts at all. The prerequisites are the part people miss: devices must be onboarded to Purview for endpoint DLP against third party generative AI sites, and the Purview browser extension must be deployed to Windows users to discover visits to third party generative AI sites, and to run endpoint DLP when the browser is Chrome.
If the organization runs Google Workspace instead, the equivalent controls are administrative: Gemini feature access can be turned off per service in the Admin console, and additional Google services can be switched on or off individually for the domain. Both belong in the same conversation as the network block, because turning off the tenant controlled assistant and leaving the consumer website reachable produces a policy that looks strong on paper and changes nothing in practice.
Rolling it out without breaking the business
Sequence matters more than tool selection. The programs that hold share four phases.
Measure first, for at least two weeks. Turn category blocking and endpoint discovery to monitor or audit mode instead of block. Then collect what actually gets hit for each user group and app. This is the only way to know which sanctioned workflows depend on a destination the category catches. Netskope's data suggests most organizations already have a policy set for some apps, which means you are usually revising an existing posture rather than starting from nothing.
Write the allowed list before the block goes live. For every department, name the AI features people are expected to use and the endpoints they need. Sanctioned developer assistants and the Microsoft 365 endpoints belong here, with vendor documented addresses. An allowlist built after the block is a helpdesk queue; an allowlist built before it is a policy.
Enforce in order of reversibility. Browser and Windows Copilot policies first, because a bad policy change is undone in one deployment cycle. Then application allowlisting in audit mode, then enforcement. Then DNS, then gateway payload rules, then TLS inspection. Each step gets a rollback path and a named owner.
Publish the route to an approved tool. Every block needs a documented alternative and a request process with a turnaround commitment. A block with no approved path trains people to use their phone.
How to allow approved tools without reopening the hole
The difference between a durable program and a temporary one is whether the exception process is designed or accidental.
Allow the specific application rather than the category. A gateway rule that permits a named AI application through granular controls, or an identity rule that permits a named enterprise tenant, is auditable and reviewable. A category exception is neither, and it silently expands as the category vendor adds domains.
Attach four fields to every exception: the business owner; the highest data classification the tool may receive; the review or expiry date; and the reason it could not be met another way. An exception without an owner becomes permanent by default.
Prefer the tenant version of a tool over the consumer version of the same tool wherever the work is legitimate. The enterprise tier is the one with an agreement and retention control. It also has an audit surface. This is also the honest argument for private deployment: if a workload must handle controlled unclassified information or protected health information, the answer is not a browser tab and a policy exception, it is a model you host inside your boundary. Petronella Technology Group, Inc. publishes both paths, the on premise AI deployment route and the broader private AI solutions practice, because the real decision is usually whether to block or to host.
Log the allowed path as carefully as the blocked one. The metric that tells you whether the program is working is not the count of blocked requests, it is the ratio of blocked attempts to approved usage over time. A falling block count with rising approved usage is success. A rising block count with flat approved usage is a shadow IT problem that has simply moved.
What blocking does not fix
Be honest with your leadership about the edges, because over promising here is how a security program loses credibility.
- Personal devices on personal networks. No network control reaches a phone on cellular. Only application level controls, mobile device management and acceptable use policy with consequences reach it.
- Screenshots. Once data is rendered on a screen, a photograph carries no file transfer to inspect. This is the well named analog hole, and it defeats file based detection entirely.
- Data that does not look sensitive. A strategy paragraph, a proprietary design, or an original code snippet matches no pattern in a detector trained on formats. Discovery finds what it was told to look for.
- Encrypted containers. Endpoint DLP does not decrypt protected files to inspect their contents, and Microsoft's documentation says so directly; the engine can react to a password protected attachment as a condition rather than reading inside it.
- Locally installed AI that generates no recognizable DNS traffic. DNSFilter publishes the clearest statement of this gap among the vendors: locally installed AI applications, downloadable LLM clients, IDE plugins that run inference on device and desktop AI assistants generate little to no recognizable DNS traffic, so to a DNS based visibility tool they do not exist. The category list only sees the tools that look like websites.
- Services that launched after the policy was written. A category is a moving list, and new assistants appear faster than any review cycle. Administrators on Cloudflare's own community forum ask exactly how to block tools that did not exist when the policy was authored.
The layered answer to all five is the same: reduce the volume that has to be caught by making the approved path easy, and make the remaining traffic visible enough that the exceptions are known rather than assumed. That is a governance and monitoring problem as much as a product one, which is what a shadow AI detection engagement is for.
Where this fits in a compliance program
The frameworks do not name chatbots. They describe outcomes a chatbot undermines, and that framing is what makes the control defensible in an assessment.
For defense contractors, NIST SP 800-171 Rev. 2 requirement 3.1.3 requires controlling the flow of controlled unclassified information in accordance with approved authorizations, and its discussion explicitly names gateways and routers as enforcement points. It names guards and encrypted tunnels, and it names firewalls, including message filtering by content. Requirement 3.13.1 covers monitoring and protecting communications at external and key internal boundaries. CMMC Level 2 security requirements are identical to NIST SP 800-171 R2 under 32 CFR 170.14, and a Level 2 self assessment produces a CMMC Status of Final Level 2 (Self) or Conditional Level 2 (Self) submitted to SPRS under 32 CFR 170.16. If your organization needs that status maintained, an unsanctioned AI tool receiving controlled unclassified information is a 3.1.3 failure with a paper trail. The CMMC Level 2 self assessment guidance on our site walks through how that status is achieved and maintained, and the CMMC Registered Provider Organization page explains the assessment support role.
For healthcare, HIPAA at 45 CFR 164.312 requires access control and audit controls for electronic protected health information. It also requires integrity protection and person or entity authentication. Transmission security is required as well. For financial services, the GLBA Safeguards Rule at 16 CFR 314.4(c) requires access controls and encryption of customer information, in transit over external networks and at rest. It also requires multi factor authentication and monitoring and logging of authorized user activity to detect unauthorized access or use. Cardholder data adds PCI DSS v4.0.1 Requirement 3.5.1, which requires the primary account number to be unreadable wherever it is stored, with keyed cryptographic hashes of the entire number when hashing is the method.
None of those citations makes a product compliant, and no single control closes them. They are the reason the control exists, and the reason a block list that nobody monitors will not survive an assessment question about how it is verified.
Two related guides go deeper. Allowlisting vs DLP vs CASB compares what each control catches and misses, and our service for blocking unapproved AI tools covers how Petronella Technology Group, Inc. designs and runs the full stack.
Related reading
- Stop Employee Data Leaks Through ChatGPT: Private AI Guide
- Private AI for CTOs: Why Regulated Teams Leave ChatGPT
- AI Acceptable Use Policy Template for SMB Teams (2026)
- Google Bard vs ChatGPT: Capabilities and Uses Compared
FAQ
Can a business actually block ChatGPT, Gemini, Claude and Copilot on its network?
You can block the major consumer surfaces reliably on managed devices and managed networks. The reliable combination uses DNS categories and secure web gateway rules. It also uses endpoint policy and identity controls. You cannot block all AI use, because a phone on cellular data, a DNS over HTTPS client you do not control, or a service reached by IP address all bypass a resolver. The realistic goal is to make the unsanctioned path hard. It must also stay visible and logged. People also need an approved path they will actually use.
Does DNS filtering alone stop employees from using AI chatbots?
No. DNS filtering blocks by domain name, so it stops the ordinary case where a browser resolves a chat domain through your resolver. It does not stop DNS over HTTPS configured in the browser or the device, it does not see a request sent to an IP address with no name lookup, and with Encrypted Client Hello deployed it does not even see the hostname of an otherwise ordinary request. DNS is the cheapest first layer, not the whole control.
What breaks when you block cloud AI services?
The predictable breakages are sanctioned developer tools. Copilot and similar assistants call their own endpoints that a broad AI block will catch. Support chat widgets embedded in vendor portals, documentation search powered by a vendor AI feature, and any line of business app that quietly added an assistant are also affected. Plan the allowlist before the block and publish it. Then test the top twenty workflows in each department.
Do Microsoft 365 Copilot and ChatGPT Enterprise count as shadow AI?
Not when they are the version your organization bought and administers. Microsoft states that prompts, responses and Graph data in Microsoft 365 Copilot are not used to train foundation models. OpenAI states that API Platform data after March 1, 2023 and ChatGPT Business, Enterprise, Edu, Healthcare and Teachers data are not used for training by default. The risk case is a personal account under consumer terms, outside your tenant, where you have no retention control and no audit trail.
What is the difference between blocking AI at the network and blocking it on the endpoint?
A network control decides which destinations traffic may reach, so it works for any device behind it but needs the traffic to pass through your inspection point. An endpoint control decides which programs run and which browser policies apply, so it follows a laptop onto hotel Wi-Fi but cannot stop a user typing into an approved browser tab. Mature programs run both, because each covers the other's blind spot.
How do you allow an approved AI tool without reopening the block?
Allow the specific application rather than the whole category. Do the same for a specific tenant or a specific endpoint. Put the exception in the same policy tool that holds the block so it is reviewed with it. Name the owner and the data classification the tool may receive. Add the expiry date and the reason. Then log the allowed path so you can see how much traffic moved from the blocked category into the approved app.
Is blocking cloud AI required for CMMC, HIPAA or GLBA?
None of those frameworks names a chatbot. They require controls that a chatbot undermines: NIST SP 800-171 requirement 3.1.3, in force for CMMC Level 2, requires controlling the flow of controlled unclassified information in accordance with approved authorizations. HIPAA at 45 CFR 164.312 requires access control and audit controls for electronic protected health information. It also requires transmission security. The GLBA Safeguards Rule at 16 CFR 314.4(c) requires access controls and encryption. The same rule requires multi factor authentication and monitoring of authorized user activity.
Start with the inventory, not the block list
If you take one thing from this guide, take the order of operations. You cannot block what you have not measured, you cannot keep a block that has no approved alternative, and you cannot defend a control you do not monitor. Run discovery first, write the allowed list second, enforce in the most reversible order third, and put a review date on every exception.
Petronella Technology Group, Inc. runs this work as a program rather than a one time configuration. The program starts with discovery of what is actually in use. It continues with the managed firewall and gateway rules that make the decision enforceable and network segmentation so the sensitive subnet is not one policy away from the whole company. It ends with the shadow AI detection reporting that tells you whether the block is still holding. Where the answer is to host the model yourself instead of blocking it, the AI practice hub covers the private and on premise options, and the data loss prevention service covers the content side of the same problem.
The fastest way to start is a conversation about what is on your network today. Call Penny at 919-348-4912, or use the contact form if you would rather write it down first. A network security assessment gives you the inventory and the current egress paths, plus the gap list, in one pass, which is the artifact every later decision depends on.
If your team needs to understand the policy side before the technical side, the 2026 security awareness training course covers acceptable use and third party SaaS. It treats shadow AI as a distinct lesson, and it is the cheapest way to make the block something employees understand rather than something they route around.
Sources
- Cloud and Threat Report: Generative AI 2025 - Netskope (netskope.com)
- Cost of a Data Breach Report 2025, IBM X-Force (ibm.com)
- RFC 8484 - DNS Queries over HTTPS (DoH) (datatracker.ietf.org)
- RFC 9849: TLS Encrypted Client Hello (rfc-editor.org)
- The AI Tools Your DNS Can't See (dnsfilter.com)
- Adding AI/ML Applications Rules in Cloud App Control, Zscaler (help.zscaler.com)
- Santa - Open source macOS security agent (northpole.security)
- App Control and AppLocker Overview (learn.microsoft.com)
- Microsoft Purview data security and compliance protections for Microsoft 365 Copilot and other generative AI apps (learn.microsoft.com)
- Govern discovered apps using Microsoft Defender for Endpoint - Microsoft Defender for Cloud Apps (learn.microsoft.com)
- Generative AI in Google Workspace Privacy Hub (knowledge.workspace.google.com)
- 2.5: Allowlist Authorized Software - CSF Tools (csf.tools)
- NIST SP 800-207: Zero Trust Architecture (nvlpubs.nist.gov)
- NIST SP 800-171 Rev. 2: Protecting Controlled Unclassified Information in Nonfederal Systems (nvlpubs.nist.gov)
- 45 CFR 164.312 -- Technical safeguards. (ecfr.gov)
- 16 CFR § 314.4 - Elements. (law.cornell.edu)
- OWASP LLM02: 2025 Sensitive Information Disclosure (genai.owasp.org)
Reference build sheets, a hardening checklist for open-weight model hosting and a data-sovereignty map for running AI on your own hardware.
Get the free guide
