Understanding AI misuse detection in CybSafe
CybSafe flags when Microsoft 365 Defender for Cloud Apps or Endpoint Data Loss Prevention (DLP) detects sensitive data being pasted or uploaded to large language model (LLM) tools. These events are captured as the behaviour action SHARED_ON_AI_PLATFORM, so they appear in behaviour reports, workflows, and analytics alongside your other Microsoft security telemetry.
Prerequisites
An active Microsoft Purview and DLP integration.
How Our AI Misuse Detection Works
Microsoft raises a
DLPRuleMatchevent with theEndpointworkload when a user copies or uploads data from their device.CybSafe receives the Microsoft Purview and DLP integration.
We parse the event payload and only operations where data leaves the device (
FileUploadedToCloudorPastedToBrowser) are considered.We compare the target domain of the event to the list of supported AI tools below. If the target domain matches an existing tool, we treat the event as AI usage. If it's not listed or has been deactivated, we treat it as a regular
SHARED_ONLINEevent instead.Based on the sensitive information type returned by Microsoft (PII, confidential data, credentials, etc.), we emit the matching behaviour event and attach the Microsoft metadata for auditing.
Supported AI tools
Tool name | Supported domain |
Anthropic Console | console.anthropic.com |
Anyword | anyword.com |
ChatGPT | chatgpt.com |
Claude | claude.ai |
Copy.ai | copy.ai |
ElevenLabs | elevenlabs.io |
Fathom | fathom.video |
Fireflies | fireflies.ai |
Gemini | gemini.google.com |
Hugging Face Spaces | huggingface.co |
Jasper | jasper.ai |
Microsoft Copilot | copilot.microsoft.com |
Midjourney | midjourney.com |
NotebookLM | notebooklm.google.com |
OpusClip | opusclip.com |
Otter.ai | otter.ai |
Perplexity | perplexity.ai |
Pictory | pictory.ai |
QuillBot | quillbot.com |
Runway | runwayml.com |
Rytr | rytr.me |
Suno | suno.ai |
Synthesia | synthesia.io |
Writesonic / Chatsonic | writesonic.com |
Troubleshooting tips
No events arriving:
Confirm the Microsoft DLP rule is in Enable mode. CybSafe ignores events when every policy rule is in
TestorTestWithNotifyUserto avoid noise.Confirm the Microsoft Purview and DLP integration is shown as active within the platform
Events show as
SHARED_ONLINE: Check whether the target domain exists in supported AI tools list. Contact support if there is a tool missing.Unexpected sensitive info type: CybSafe only maps Microsoft's out-of-the-box sensitive information types. New additions from Microsoft may require a mapping update. Please contact support if you believe there is a missing type.