Uniti Solutions AI Security Moves Shadow AI Control Into the Managed Network

Uniti Solutions launched its first dedicated managed AI security service, shifting the control of workplace AI activity into an existing network security platform. The Uniti Solutions AI Security offering targets prompts, responses, applications, models, and autonomous agents that conventional firewalls often cannot evaluate.

The service is powered by Cato Networks and sold as an add-on to Uniti’s managed Secure Access Service Edge offering. SASE combines networking and security functions in a cloud-delivered architecture. That distribution model matters because the new controls sit in the traffic path already used by participating customers.

The announcement is not simply another security vendor attaching “AI” to an established product. Uniti is betting that enterprises want a service provider to operate AI controls across approved and unapproved tools. Microsoft, Google, and specialist security companies are pursuing the same problem through their own platforms.

That creates the central tension. A managed network service can give security teams one enforcement point, but visibility alone does not produce a workable AI policy. Customers still need to decide which prompts are acceptable, which data requires protection, and when an automated block causes more harm than it prevents.

Uniti Solutions AI Security Watches More Than Application Access

The service extends network security from controlling access to interpreting what users and AI systems exchange.

Uniti announced the offering on October 13, 2026. Its AI Security release describes three primary functions: discovering AI use, analyzing interactions, and applying real-time guardrails.

Discovery covers approved and unapproved AI applications, models, and agents across participating users and locations. This inventory function addresses shadow AI, meaning AI systems used without an organization’s approval or governance.

The service also examines prompts, responses, and actions. Uniti says the underlying system considers intent instead of relying only on keyword matches. That distinction matters when a prompt contains ordinary language surrounding confidential source code, financial information, or customer records.

Real-time guardrails provide the enforcement layer. According to Uniti, administrators can block misuse or redact sensitive information while an interaction is happening. That approach aims to preserve legitimate access instead of treating every unapproved AI tool as an automatic denial.

The service covers three different enterprise AI paths. Employees might use public third-party assistants, developers might build internal AI applications, and autonomous agents might act across connected systems. Each path creates different identities, data flows, and potential consequences.

An employee pasting a customer record into a chatbot creates a direct disclosure risk. An internal application can expose excessive data because of weak access controls. An agent introduces another concern because it can take actions through tools and connected accounts.

Uniti is offering the service only to customers using its Cato-powered managed SASE service. It is therefore an expansion of an existing delivery relationship, not a standalone security product for every enterprise.

That limitation also explains the commercial logic. Uniti already provides network connectivity, implementation, and operational support for these customers. It can add AI traffic controls without asking them to establish another independent security operations workflow.

The company says its broader business reaches nearly 95% of business, government, and education customer locations in the United States. That figure describes its service reach, not adoption of the new AI offering.

Uniti has not disclosed customer counts, deployment results, detection accuracy, or independent assessments for the service. The announcement establishes its intended capabilities, but not their performance in a production environment.

The immediate change is still concrete. Existing managed SASE customers now have an option for governing AI interactions through the same provider that operates their network security layer.

Shadow AI Has Become a Data-Control Problem

Enterprises are under pressure because employees adopted AI faster than many security teams established enforceable rules.

Uniti cites more than two million OpenAI business customers as evidence that enterprise AI has moved beyond limited experimentation. OpenAI’s enterprise AI report also reported more than seven million ChatGPT workplace seats.

Those figures do not show how many organizations have weak governance. They do show that AI tools now operate across large numbers of workplace accounts and repeatable business processes.

The more revealing statistic comes from a Microsoft and LinkedIn workplace survey. It found that 78% of surveyed AI users brought their own AI tools to work. The original workplace AI study framed that behavior as widespread individual adoption outside formal company programs.

Bring-your-own-AI behavior creates a difficult enforcement problem. Blocking a domain might stop one service, but employees can move to another website, browser extension, application, or embedded assistant.

Approved tools do not eliminate the risk either. A sanctioned chatbot can still receive confidential text that a user should not share. An approved internal agent can access more records than its task requires.

That is why shadow AI differs from a simple software inventory problem. Security teams need to know which tools are present, but they also need context about identities, data, prompts, and resulting actions.

Microsoft’s guidance defines shadow AI as the use of AI tools without the knowledge, approval, or governance of an organization’s technology teams. Its shadow AI blueprint recommends discovery, application controls, data-loss prevention, auditing, and investigation.

Uniti and Cato are addressing the same control sequence from the managed network layer. Traffic visibility can reveal third-party AI services that procurement records or identity systems missed. Inline inspection can then support policies based on the information being transmitted.

This model places pressure on several existing security functions. Data governance teams must define protected information. Network teams must implement enforcement without disrupting legitimate work. Security operations teams need useful alerts rather than another stream of low-context events.

Application owners also face scrutiny. If an internal AI system appears in the inventory, its owner must explain which data it uses and which actions it can perform. An agent cannot remain an informal experiment after it starts accessing production systems.

The service therefore responds to an organizational gap as much as a technical one. Employees have strong incentives to use efficient AI tools. Security teams cannot manage that demand through acceptable-use documents alone.

A workable program needs enough visibility to identify risky behavior and enough precision to avoid blocking ordinary research, drafting, or analysis. Uniti’s proposition is that managed enforcement can close that gap for customers already routing traffic through Cato.

Cato AI Security Turns SASE Into the Enforcement Point

The technical bet is that AI governance works better when controls follow users and traffic across applications, locations, and devices.

Cato’s SASE platform combines network access and security inspection in a cloud-native service. Uniti adds implementation, connectivity, monitoring, and operational support around that platform for managed customers.

This structure gives the Uniti AI security service a broad observation point. A user might access a public chatbot from an office, a remote connection, or a cloud-hosted application. SASE policies can follow that traffic when it passes through the managed service.

Traditional firewalls largely evaluate addresses, ports, protocols, applications, and known threat indicators. These controls remain important, but they do not fully explain the meaning of a prompt or response.

A request can be technically permitted while still creating a data exposure. For example, an employee might ask an approved assistant to summarize a confidential acquisition document. The connection is legitimate, yet the content violates company policy.

Uniti says Cato AI Security can inspect the intent of prompts and responses, detect sensitive data, and take inline action. It can also inventory hundreds of AI tools and distinguish sanctioned services from unsanctioned ones.

Redaction represents a less disruptive option than complete blocking. A policy could remove a protected identifier while allowing the rest of a prompt to proceed. In theory, that preserves productivity while reducing disclosure risk.

However, effective redaction depends on classification quality. A system must recognize protected data in varied formats and understand the surrounding context. It must also avoid deleting ordinary information that users need for legitimate work.

Agents raise the stakes because they can act instead of only generating text. An agent might query a database, create a support ticket, send a message, or modify a record. Its security profile includes identity permissions, tool access, instructions, and data exposure.

Cato’s platform strategy has expanded around these agentic risks. Earlier in 2026, the company announced native AI security capabilities and an agentic threat prevention service. Uniti is packaging parts of that direction as an operated service for its customers.

The partnership is already commercially established. In August 2026, Uniti renewed a multiyear agreement with Cato and received Advanced Partner status. Uniti says fewer than 2% of Cato’s global partners hold that designation.

The companies also describe Uniti as the first North American managed provider to deliver a Cato-powered managed SASE service. Those are company claims about partnership status, not independent measurements of security outcomes.

Still, the relationship reduces one source of integration risk. Uniti is not assembling an unfamiliar AI security stack immediately before launch. It is extending a platform that its technical teams already deploy and support.

The mechanism also creates a boundary. Controls can inspect only the interactions visible through integrated traffic, identities, endpoints, or applications. Encrypted flows, unmanaged devices, direct application integrations, and unsupported channels can create gaps.

Customers should therefore ask which paths the service sees. They should test browsers, desktop applications, mobile devices, APIs, internal models, and agent tools separately. “AI visibility” is meaningful only when its coverage is defined.

Microsoft and Google Are Competing for the Same Control Layer

Uniti’s main opponent is not one managed provider, but the platform-native security model already available inside major enterprise technology estates.

Microsoft provides AI discovery and data controls through Purview, Defender for Cloud Apps, Entra, and Intune. Purview can apply data-loss prevention policies, audit interactions, classify information, and investigate risky activity.

Its advantage comes from proximity to Microsoft identities, endpoints, productivity data, and Copilot products. An organization deeply invested in Microsoft 365 might prefer controls that inherit existing labels and compliance policies.

Microsoft also documents support for selected third-party AI applications. Its AI protection guidance groups Microsoft copilots, registered enterprise AI applications, and browser-detected generative AI services into distinct control categories.

Google is building a comparable portfolio around Security Command Center, Sensitive Data Protection, Model Armor, and its cloud AI services. Model Armor screens prompts and responses for prompt injection, sensitive data, harmful content, and malicious links.

The Google approach is attractive when developers build AI applications on Google Cloud or need model-level protections through APIs. Microsoft has a similar advantage when AI workflows remain inside its identity and productivity environment.

Uniti and Cato offer a different route. Their enforcement point is the converged network and security service rather than one productivity suite or cloud development platform.

That can help an enterprise with a mixed technology estate. Employees may use Microsoft 365, Google Workspace, public AI assistants, specialized software, and internally developed agents. A network-level policy can provide a shared layer across those environments.

The model also reduces the operational burden for customers lacking a large internal security team. A managed provider can help configure policies, monitor events, and support changes instead of handing administrators another console.

However, platform-native tools can have richer context inside their own environments. Microsoft can use sensitivity labels, identity signals, device state, and document permissions. A network layer might see transmitted content without understanding every underlying business entitlement.

This is not a simple feature comparison. Customers must decide which control point has the context they need and which team can operate it consistently.

Some organizations will combine both approaches. Native tools can protect data and identities inside a cloud platform, while SASE controls watch broader traffic. That layered design can improve coverage, but it can also duplicate alerts and enforcement.

Conflicting policies create practical problems. One system might allow a prompt after redaction while another blocks the session. Separate tools might record the same event under different user, application, or risk labels.

Uniti’s managed service must therefore prove that consolidation creates operational value. The strongest evidence would include shorter investigation times, fewer unmanaged applications, reduced sensitive-data exposure, and acceptable false-positive rates.

The announcement does not provide those measurements. Until deployments generate them, Uniti Solutions AI Security remains a credible delivery model supported mainly by product capabilities and an established partnership.

Prompt Inspection Creates Its Own Security Tradeoffs

The same visibility needed to control AI can expose highly sensitive employee and company interactions to another inspection system.

Prompt inspection sounds straightforward until organizations consider the material inside those prompts. Employees might submit source code, legal advice, medical information, customer records, security findings, or unreleased financial data.

A control that reads prompts and responses becomes part of the sensitive-data path. Customers need clear answers about processing locations, retention, administrator access, encryption, regional routing, and incident response.

They should also determine whether inspected content trains any model. The service announcement does not describe data retention or model-training terms. Those details require contractual and technical review before deployment.

False positives present another challenge. A developer might legitimately analyze a code sample that contains words resembling credentials. A finance employee might use a sanctioned tool with properly masked records. Overly broad controls could interrupt both tasks.

False negatives are equally serious. Sensitive information can appear in unusual formats or become identifiable only when combined with other context. Intent analysis can improve detection, but no announcement establishes perfect understanding.

AI applications also face threats beyond accidental employee disclosure. The OWASP risk list includes prompt injection, sensitive information disclosure, improper output handling, and excessive agency.

Prompt injection uses crafted content to influence a model’s behavior. An agent can encounter hostile instructions inside documents, websites, emails, or other retrieved material. That risk exists even when the employee follows company policy.

Inline inspection can contribute to defense, but it cannot replace secure application design. Developers still need strict authorization, limited tool permissions, input handling, output validation, and human approval for consequential actions.

The difference between employee AI use and internally built agents also matters. Browser controls can govern a worker sending text to a public assistant. They do not automatically correct an internal agent with excessive database permissions.

Customers should avoid treating one inventory as a complete AI asset register. Network observations need reconciliation with cloud accounts, API keys, application repositories, identity systems, model gateways, and procurement records.

Policy design should begin with a narrow set of high-confidence protections. Organizations can first block secrets, regulated identifiers, and clearly unauthorized applications. They can then expand controls using evidence from monitored activity.

A monitor-only period can reveal how employees actually use AI before enforcement begins. Security teams can identify business-critical workflows, recurring data types, and departments that need approved alternatives.

Clear user feedback is also essential. A blocked prompt should explain which policy applied without revealing detection logic that attackers can easily evade. Users need a safe next action, not only an error message.

The managed service can help with those operating details, but customers remain accountable for policy choices. Uniti cannot determine every organization’s acceptable balance between productivity, privacy, compliance, and security.

The central tradeoff is therefore unavoidable. More inspection can reduce unmanaged disclosure, yet it also concentrates sensitive interaction data and introduces another decision engine into employee workflows.

Three Signals Will Show Whether the Service Delivers

The next test is not another feature announcement, but evidence that customers can govern AI without driving it further underground.

The first signal is measurable adoption among Uniti’s managed SASE customers. Uniti has not disclosed how many customers will enable the add-on or which industries will adopt it first.

Adoption within regulated organizations would strengthen the service’s credibility because those buyers require detailed controls, auditability, and contractual assurances. Limited uptake would suggest that customers prefer native platforms or are not ready for prompt-level enforcement.

The second signal is operational evidence. Uniti and Cato should eventually report deployment coverage, blocked disclosures, policy changes, investigation times, and false-positive trends. Aggregated results can demonstrate value without exposing individual customer data.

Detection counts alone would be weak evidence. A system can produce many alerts because its policies are noisy. Better measures include reduced unsanctioned use, higher migration to approved tools, and faster resolution of verified incidents.

The third signal is how the service handles autonomous agents. Agent traffic creates a more demanding test than employee chatbot use because actions can affect external systems and business records.

A credible agent security program must connect network activity with agent identity, delegated permissions, tool calls, and data access. If controls remain focused on browser prompts, the service will cover only part of the emerging risk.

These signals will also clarify Uniti’s position against platform-native security products. Broad cross-platform visibility would support the managed SASE model. Richer context and simpler operations inside Microsoft or Google environments would favor native controls.

Enterprises do not need to wait for a winner before improving governance. They can inventory approved AI systems, define protected data, restrict agent permissions, and test how controls behave in representative workflows.

They should also record where important knowledge enters an AI process. That includes copied text, uploaded documents, connected repositories, retrieved records, and automated tool outputs. A maintained AI knowledge base can make those information boundaries easier to review.

Uniti Solutions AI Security arrives at a useful moment because enterprise AI has spread beyond centrally approved applications. Its managed delivery model offers customers a practical enforcement point across a mixed environment.

The launch does not establish that every AI interaction can be classified correctly. It also does not remove the need for secure application design, identity controls, data governance, or informed employee behavior.

The most important question for buyers is operational: can the service reduce risky AI use while preserving the workflows employees already depend on? Organizations considering the add-on should begin with a coverage map, a monitor-only baseline, and several high-confidence data policies. They should then test redaction, blocking, agent activity, and incident investigation with real business scenarios. The resulting evidence will matter more than the number of AI tools listed in a dashboard. If Uniti can turn those controls into lower exposure and clearer accountability, its managed network position becomes valuable. If users simply route around enforcement, shadow AI will remain hidden rather than controlled.