Compare Shadow AI Protection Architectures

Criterion
How it works	Decrypts traffic on the network path (MITM), inspects it and re-encrypts it. Uniquely, it can mask ID and card-number patterns in a prompt instead of blocking it.	Injects code into the app's memory to hook its encryption functions, reading plaintext before TLS or certificate pinning ever runs. Allow or block only.	An OS-level agent that judges uploads, copies and pastes by the source file: its Purview tag, or ID/card-number patterns in its content. Block, warn or audit; no masking.	Traces clipboard and file events back to a sensitive source, without reading content. It's also what switches off an Electron app's certificate pinning so a network proxy can read its traffic. Allow or block only.	Reads the prompt's own meaning, and what it's asking the AI to do, on-device before it's sent; no tag or file event required. Allow or block only.	Coding agents are pointed at it instead of the vendor. It reads every request as plain text, masks or blocks ID and card-number patterns, and sends the rest on under the org's own key.
Detection method	Pattern matching · Purview tag · Route & identity	Pattern matching	Purview tag · Pattern matching	Lineage	Semantic	Route & identity · Pattern matching · Semantic
User experience	Pinned apps break	Crashes and lag	Native OS warning	Over-blocks harmless text	In-app message	Agent keeps working
Upkeep	High	Very high	Low, but needs E5	Low	Moderate	Moderate
Price (per user / month)	$3 – $10	$10 – $25	$15 – $30	$15 – $30	$15 – $30	—
Coverage gaps	Pinned desktop apps they reject its certificate, so it can't read their traffic Files an agent reads on an enterprise account it's sanctioned use, so the proxy lets it through without reading it Uploaded proprietary files when untagged there's no ID or card-number pattern to match Pasted proprietary text and proprietary text typed from memory there's no ID or card-number pattern to match Screenshots an image has no text to scan and no link back to its source	Anything on macOS macOS blocks the memory hook it depends on Proprietary content there's no ID or card-number pattern to match Screenshots an image has no text to scan and no link back to its source	Pasted proprietary text, uploaded proprietary files and proprietary files an agent reads when untagged there's no Purview tag and no ID or card-number pattern Screenshots an image has no text to scan and no link back to its source Typed text typing isn't a copy, paste or upload, so there's no device action to judge	Pasted text on macOS macOS restricts clipboard tracking Sources outside its graph it has nothing to trace them back to Screenshots an image has no text to scan and no link back to its source Typed text nothing was copied, so there's no event to trace Files an agent reads the agent reads them itself, with no paste or drop to trace	Uploaded files it reads prompts, and a whole file isn't one Screenshots an image has no text to scan and no link back to its source Files an agent reads it reads what's typed, and the agent attaches the files itself	Browsers and desktop apps they go straight to their vendor and can't be pointed at a gateway Personal keys and logins they go straight to the vendor's API and never reach the gateway Proprietary content there's no ID or card-number pattern to match Screenshots an image has no text to scan and no link back to its source
Compliance helped	GDPR uploaded files with PII and PII an agent reads Sovereignty uploaded files with PII and PII an agent reads AI Act coding agents ISO 42001 / NIST AI RMF pasted PII, uploaded files, typed PII and files an agent reads	GDPR PII Sovereignty PII ISO 42001 / NIST AI RMF PII	GDPR pasted PII, uploaded files with PII and PII an agent reads Sovereignty pasted PII, uploaded files with PII and PII an agent reads ISO 42001 / NIST AI RMF pasted text, uploaded files and files an agent reads	GDPR pasted PII and uploaded files with PII Sovereignty pasted PII and uploaded files with PII ISO 42001 / NIST AI RMF pasted text and uploaded files	GDPR pasted PII and typed PII Sovereignty pasted PII and typed PII AI Act every case ISO 42001 / NIST AI RMF pasted text and typed text	GDPR uploaded files with PII, for coding agents on the org's account Sovereignty uploaded files with PII, for coding agents on the org's account AI Act every case, for coding agents on the org's account