Do you know how many AI tools
your employees are using right now?
Visibility is the first problem: 69% of organizations suspect or have evidence that employees are using prohibited public GenAI (Gartner, 2025). Tangerin AI detects thousands of tools, classifies by risk, and generates auditable evidence for NIST AI RMF, SOC 2, ISO 42001, HIPAA and more, in under an hour.
69%
of organizations suspect or have evidence that employees are using prohibited public GenAI
Gartner, 2025
89%
of companies already use AI regularly in at least one business function
McKinsey, 2026
6,500+
AI tools cataloged
Tangerin AI catalog
24
regulatory frameworks covered
US, EU + Brazil
$11.5M
average cost of a data breach in the U.S.
IBM, 2026
Shadow AI doesn't ask permission. It grows every day, on every device.
89% of companies already use AI regularly, but only 44% are scaling it across the enterprise (McKinsey, 2026). Every employee who discovers ChatGPT expands your regulatory attack surface while governance fails to keep up. Without visibility, there is no governance.
69%
of organizations suspect or have evidence that employees are using prohibited public GenAI (Gartner, 2025)
Invisible to IT
Employees install ChatGPT, Claude, Cursor and DeepSeek without any approval. Processes run in the background. IT doesn't know until something goes wrong.
$11.5M
average cost of a data breach in the U.S., an all-time high (IBM, 2026)
Regulators don't accept "I didn't know"
NIST AI RMF, ISO 42001 and the EU AI Act all expect you to know which AI systems are in use. The NIST framework's GOVERN 1.6 asks for an AI system inventory outright. Auditors and customers are asking now, not in 2027.
$99
/mo on the Starter plan, 14-day free trial
The cost of the problem exceeds the solution
Shadow AI incidents cost $5.39M on average, against $4.99M for the global average (IBM, 2026). A point-in-time audit is out of date the day after. Tangerin AI starts at $99/month and runs 24/7.
The good news: full visibility in under an hour once installed. From the Business plan up, nothing to install on endpoints, no analyst dependency and no sales meeting.
Start free →89%
increase in attacks by AI-enabled adversaries in 2025
CrowdStrike, 2026 Global Threat Report
The threat isn't hypothetical, and the defense already has a name.
As employees adopt AI without controls, attackers accelerate with AI too. CrowdStrike's #1 recommendation for 2026 is blunt: monitor employees' use of AI tools, enforce access controls, and classify data to prevent leaks.
That's exactly what Tangerin AI does: AI governance as infrastructure, always on.
Two paths. Same coverage.
From the Business plan up, connect your existing SIEM, with zero endpoint installation. SMBs and technical teams install the lightweight agent for full process and browser coverage.
Via SIEM / NGFW
Business and up · zero endpoint installation
Connect
Route your SIEM's CEF feed to Tangerin AI. One URL, one token. No agent, no endpoint infrastructure changes.
In: Palo Alto · Fortinet · Check Point · Netskope · Zscaler · Google SecOps · any SIEM via CEF. Out: Splunk · Sentinel.
Visualize
Within minutes, see which AI tools are on the network (by user, department, and risk), feeding the same executive dashboard.
3,400+ active tools · email/AD identity · allowed/blocked action
Via Agent
Full coverage · process, DNS and browser
Install
Deploy the lightweight agent to workstations in minutes. One-line script for Windows, macOS or Linux. No infrastructure changes.
Windows x64 · macOS Apple Silicon · macOS Intel · Linux x64
Discover
Automatic detection via processes, DNS, browser extensions, and software inventory. Every tool identified, categorized, and risk-classified.
3,400+ active tools · 3 detection sources · risk badge per workstation
Classify
Mark each tool as Allowed, Restricted, or Blocked. A daily email digest of the blocked tools in use (Business and up) and a live event list in the console.
Daily email digest (Business and up) · Live events in the console
Verify
Executive reports, auditable evidence, and immutable compliance history. From CISO to board, each persona sees the detail level they need.
Executive PDF · Auditable score · Linked evidence
Both paths feed the same dashboard, the same AI Governance Index, and the same compliance evidence, and complement each other when you add the second.
Discover
Every AI tool. Visible. Immediately.
Tangerin AI detects via SIEM/NGFW (zero endpoint installation) or via lightweight agent for full process, DNS and browser extension coverage. 6,500+ tools cataloged and classified by risk.
- Two paths: SIEM (agentless) or lightweight agent
- 6,500+ tools cataloged, one of the largest catalogs on the market
- Risk badge per workstation: Critical · High · Medium · Low
- Daily email digest of the blocked tools in use (Business and up) and a live event list in the console
Shadow AI detected
23 toolsDeepSeek R1
Language models · 3 workstations
ChatGPT
Language models · 47 workstations
Cursor AI
Code generation · 12 workstations
Midjourney
Image · 8 workstations
GitHub Copilot
Code generation · 89 workstations
Zapier AI
Automation · 6 workstations
Verify · Frameworks
24 frameworks. Automatic evidence.
NIST AI RMF, SOC 2, ISO 42001, the EU AI Act, HIPAA, and 19 more frameworks, with automatic crosswalk. Execute one action and all equivalent standards are updated at the same time.
- Automatic crosswalk between frameworks, no rework
- DPIA / FRIA generator with real environment data
- AI usage policy with versioning and registered acceptance from each employee (name, date and IP)
- Immutable compliance history for SOC 2 Type II
Compliance by Framework
77% averageActive automatic crosswalk
Adding a vendor with DPA fills ISO 27001 A.5.19 · SOC 2 CC9 · PCI DSS 12.8 · HIPAA §164.308: one action, four frameworks.
Verify · Reports
From endpoint to board. One click.
Shadow AI Risk Report in PDF, in Executive, Technical, and Governance versions. Immutable history. Auditable score week by week. Ready for board, directors and auditors, generated automatically.
- Executive report ready for board in PDF
- AI Governance Index with week-by-week trend
- Evidence automatically linked to each framework
- Immutable history for SOC 2 Type II and audits
Speaks the language of operators, compliance officers, and decision makers
Each profile accesses the level of detail they need, without opening a ticket to IT.
Technical visibility auditors expect
- Complete inventory: software, extensions and AI startup items per workstation
- Risk badge per workstation: Critical / High / Medium / Low
- User identified with corporate domain (CORP\user)
- 6,500+ tools classified by risk, category and detection source
- Daily email digest of the blocked tools in use (Business and up) and a live event list in the console
- Audit log of all administrative actions
Continuous compliance with auditable evidence
- 24 frameworks: NIST AI RMF, SOC 2, HIPAA, ISO 42001, EU AI Act and more
- Automatic crosswalk: meet one control, propagate to all equivalents
- DPIA / FRIA generator with real environment data
- Vendor registry with DPA status and training risk
- Formal policy with versioning, approvals and registered acceptance from each employee (name, date and IP)
- Immutable compliance history for SOC 2 Type II
Quantified risk, informed decisions
- AI Governance Index with automatic executive summary for the board
- Shadow AI Risk Report in PDF, ready for board and auditors
- AI Governance Index in 4 bands: Critical → Attention → Acceptable → Leader, with a target calibrated to your industry and size
- Prioritized action plan with estimated impact before execution
- Week-by-week Shadow AI, risk and compliance trend
- Mapped regulatory exposure: NIST AI RMF, EU AI Act and ISO 42001
From zero to control in 4 steps
Tangerin AI tracks and measures every stage, with real data, not subjective perception.
Discover
A complete map of AI use and your exposure. You know what is at risk.
Assess
The size of the risk and the cost, in numbers. You know where to start.
Govern
Decide and act: policy, blocking and a prioritized action plan.
Verify
Auditable evidence for the board and the auditor.
Regulators, auditors and customers are already asking. Do you have the evidence?
HIPAA already applies to patient data today, ABA Formal Opinion 512 covers how lawyers use generative AI, and enterprise buyers ask vendors how their AI is governed. This is not a future threat. It is a current requirement.
Financial
68%
of breached organizations had no AI governance to manage AI or detect shadow AI (IBM, 2026)
Account data, deal terms and internal financials pasted into a public AI tool leave your control the moment they are sent. Without an inventory, you cannot show auditors which tools touched them.
Typical price range: $579–2,299/mo
Legal
Op. 512
ABA formal opinion on generative AI (2024)
ABA Formal Opinion 512 (2024) says lawyers must understand how a generative AI tool uses client data and, for self-learning tools, generally obtain informed consent before client information goes into a prompt.
Typical price range: $99–579/mo
Healthcare
$4.99M
global average cost of a data breach (IBM, 2026)
Under HIPAA, a vendor that handles PHI on your behalf needs a business associate agreement (BAA). Pasting patient data into a tool without one can be a violation, and you cannot prove what you never inventoried.
Typical price range: $579–2,299/mo
Technology & SaaS
$99
entry point, with the first auditable evidence in minutes
Enterprise clients require AI governance evidence as a prerequisite for signing a contract.
Typical price range: $99–579/mo
24 regulatory frameworks. One platform. Automatic evidence.
Continuous compliance tracking for the leading AI, privacy and security standards: NIST AI RMF, SOC 2, HIPAA, ISO 42001, the EU AI Act and, for operations in Brazil, LGPD.
Automatic crosswalk between frameworks
Different standards require the same thing, just with different names. Tangerin AI identifies equivalent controls and propagates automatically: you execute one action and all applicable standards are updated at the same time.
Practical example
Adding an AI vendor with a security assessment automatically fills ISO 27001 A.5.19 · SOC 2 CC9 · PCI DSS Req. 12.8 · HIPAA §164.308: one action, four frameworks covered.
AI Governance & Risk
5 frameworksNIST AI RMF
NIST AI 100-1
ISO 42001
ISO/IEC 42001:2023
EU AI Act
Regulation (EU) 2024/1689
OECD AI
OECD Principles 2019
UNESCO AI
UNESCO Rec. 2021
Privacy & Data
3 frameworksHIPAA
45 CFR Parts 160/164
GDPR
Regulation (EU) 2016/679
ISO 27701
ISO/IEC 27701:2025
Security & Audit
4 frameworksSOC 2
AICPA Trust Services Criteria
ISO 27001
ISO/IEC 27001:2022
PCI DSS
PCI DSS v4.0.1
COBIT
COBIT 2019
Corporate Compliance
1 frameworksSOX
Sarbanes-Oxley Act
Brazil (for companies operating there)
11 frameworksLGPD
Law 13.709/2018
PL 2.338
Brazilian AI Bill
EBIA
Brazilian AI Strategy
Marco Civil
Law 12.965/2014
BACEN 4.893
CMN Res. 4,893/2021
SUSEP 638
SUSEP Circ. 638/2021
CFM 2.454
CFM Res. 2,454/2026
CVM 35
CVM Res. 35/2021
FEBRABAN
Cyber Lab guide
CNJ 615
CNJ Res. 615/2025
Anti-Corruption
Law 12.846/2013
Auditable inventory
Complete record of all detected tools with category, risk, and immutable history, the foundation for NIST AI RMF (GOVERN 1.6) and ISO 42001.
Policy with lifecycle
Formal policy with automatic versioning, registered approver, review deadline, and registered acceptance from each employee (name, date and IP).
Immutable history (SOC 2)
Compliance score calculated daily and preserved, which demonstrates continuous improvement for SOC 2 Type II and audits.
AI governance as infrastructure, not as an audit checklist
Shadow AI is not a one-off compliance problem. It's an attack surface that grows with every new employee who discovers ChatGPT, Cursor or Zapier AI.
Tangerin AI treats governance as infrastructure: always active, always monitoring, always generating the evidence that regulators, auditors, and the board need to see.
Continuous governance, not point-in-time
No manual reports or annual audits needed. Runs 24/7, with alerts, evidence and reports generated automatically.
From technical to executive
A CISO sees events and inventory. A DPO sees frameworks and evidence. A CEO sees score and board report. One platform.
Privacy by design
The agent captures only usage metadata: which tool, when, by whom. Never accesses prompt content or documents.
Built for Shadow AI
Not a module added to another platform. A specialized solution, with every detail designed to discover, assess and govern AI.
The right plan for your company size
14-day trial on any plan. No long-term contract on monthly. Annual plan with 8% discount.
Starter
For companies starting AI governance. Immediate visibility.
$3.96/workstation
$1,089/yr
14-day free trial · Corporate email
Business
Documented compliance and board-ready reports.
$2.32/workstation
$6,369/yr
14-day free trial · Corporate email
Enterprise
For large companies with multiple units and advanced compliance.
$1.53/workstation
$25,289/yr
14-day free trial · Corporate email
Scale
From 2,000 workstations. Volume pricing, unlimited admins.
$1.17 – 1.75/workstation
Starting price for 2,000 workstations
14-day free trial · Corporate email
Transparent pricing, no salesperson
Public pricing in US dollars and self-service signup. No negotiation, no sales proposal.
Native Brazilian compliance
BACEN, SUSEP, CNJ 615, LGPD, and PL 2.338 pre-configured for companies operating in Brazil, alongside NIST AI RMF, ISO 42001 and the EU AI Act. Prices in US dollars.
Data in Brazil, privacy by design
Usage metadata only. We never read your employees' AI conversation content.
Every day without visibility is a day of unmanaged risk.
Once installed, discover in under an hour how many unauthorized AI tools exist in your company and what they represent in regulatory risk.