Cloudbrink Veraify: Shadow AI Discovery Is the Easy Half

Cloudbrink Veraify is a new endpoint tool for finding shadow AI across browsers, desktop apps, and command lines. Discovery is the easy half. The half that stops a leak is telling a personal AI account from the enterprise tenant on the same service and blocking the sensitive upload on the device, and dope.security does both from the single agent that already runs your web gateway.

What Cloudbrink just launched

In November 2026, Cloudbrink introduced Veraify, an AI security platform aimed at the use of unapproved AI tools. According to the launch, its endpoint agent identifies AI activity across browsers, native applications, and command-line tools, gives admins visibility into prompts and uploads, and lets them set policy around sensitive data in prompts and uploaded files. Cloudbrink is a zero-trust access company, founded in 2019, known for a low-latency edge built on mutual TLS 1.3 and short-lived certificates.

The launch is a useful signal. Endpoint visibility is finally where the market agrees shadow AI has to be caught, because that is where it runs. The question for a buyer is not whether Veraify can see AI usage. It is what the tool does after it sees it, and what else you have to buy to make the seeing matter. For the wider field, our roundup of shadow AI governance tools for 2026 is the place to start.

What Veraify appears to cover

From the public launch material, Veraify discovers AI tools in use across the three surfaces that matter: the browser tab, the installed desktop client, and the CLI. It surfaces prompts and uploads and supports policy on sensitive data moving into them. That is a solid discovery-plus-policy story, and it is the right set of surfaces. Our own view on why those three surfaces are the whole game is in detecting shadow AI in desktop apps, IDEs, and CLIs.

Cloudbrink has not published, at least not yet, whether Veraify separates a personal AI account from a corporate tenant on the same domain, how deep its prompt inspection goes, or what it costs. Those are not knocks. They are the exact questions any endpoint AI tool should answer before it goes on a purchase order, so treat them as open items to verify with Cloudbrink rather than settled facts.

The three questions that separate a real control from a dashboard

Shadow AI tooling lives or dies on three capabilities. Discovery is table stakes. The other two are where leaks actually get stopped.

1. Can it tell a personal account from the enterprise tenant on the same service?

The highest-value control in AI governance is allowing corporate ChatGPT while blocking personal ChatGPT, on the same domain. That needs an HTTP header inspected inside decrypted TLS on the device. A tool that can only block the domain forces you to choose between banning a useful tool and leaving the personal account wide open. dope.security makes that split with Cloud Application Control, so people keep the sanctioned tool and lose the personal side door.

2. Does it understand the data, or just match patterns?

Warning on a keyword is noisy and easy to evade. Dopamine DLP reads the prompt and the attached file by meaning, on the device, and blocks the ones that carry PII, PCI, PHI, or intellectual property, with far fewer false positives than regex rules. Meaning-based classification is the difference between a control people trust and one they route around.

3. Does it enforce, or just report?

Visibility that ends in a report leaves the risk in place. The control has to block on the device, before the upload leaves, and the policy has to land on every endpoint instantly. That is the bar, and it is the bar whether the tool is Veraify, a browser extension, or a cloud proxy.

Veraify versus an on-device SWG

Here is the fair comparison, with the open questions kept open.

Where Veraify is interesting

Veraify puts discovery on the endpoint across browser, desktop, and CLI, which is the correct architecture for catching shadow AI, and it comes from a vendor with real zero-trust access engineering behind it. If you are already a Cloudbrink access customer, a shadow-AI module inside that platform is a natural add.

Where dope.security goes further

dope.security is the lead pick because the AI control is not a separate product bolted onto an access platform. It is part of the same on-device agent that runs your secure web gateway, so discovery, account-level control, and prompt DLP are one deployment, one console, one policy push.

• Account-level control: dope.security separates personal from enterprise accounts on the same AI service and blocks the personal one; Veraify's account-level behavior is not yet documented, so confirm it.
• Semantic DLP: Dopamine DLP classifies prompts and uploads by meaning on the device; pattern matching warns on keywords and misses paraphrase.
• One agent, not two: dope.security runs SWG, Cloud Application Control, and endpoint DLP in a single sub-100 MB agent; stacking a standalone AI tool on top of a separate gateway is two agents and two consoles.
• Transparent pricing and a free trial: dope.security publishes pricing and offers a free production trial; Veraify pricing is not public yet.

Why the AI control and the web gateway should be one agent

AI governance is not a new category that deserves its own agent. It is web traffic and file movement, which is exactly what a secure web gateway already inspects. When the AI control lives in the same on-device agent as the gateway, three things get simpler. You deploy once. You write policy once. And you get one attribution trail: which user, which app, personal or corporate account, how many megabytes, blocked or allowed. Splitting that across an access platform plus a separate AI module means two sources of truth that have to agree. See the single-agent model in action on the dope.swg product page, and the discovery view in AI visibility across every AI app.

It also deploys like a gateway, not a project. A Fortune 100 team scaled dope.security from 900 to over 18,000 devices in weeks, silently through Intune. You are not standing up new infrastructure to govern AI; you are turning on a policy.

What to test before you buy any shadow-AI tool

Run the same proof on Veraify, on dope.security, on anything. Pick one AI service your team uses. Allow the enterprise tenant, block the personal account on the same domain, and try to upload a file with real sensitive data in it. A tool that passes all three catches the usage, keeps the sanctioned tool, and stops the leak. A tool that only lights up a dashboard caught the usage and stopped nothing. Our guide to one-click AI blocking and shadow AI detection shows what passing looks like.

Frequently Asked Questions

What is Cloudbrink Veraify?

Veraify is an AI security platform Cloudbrink launched in November 2026. Its endpoint agent identifies AI usage across browsers, native apps, and command lines, surfaces prompts and uploads, and supports policy on sensitive data moving into AI tools. Cloudbrink is a zero-trust access vendor, so Veraify extends that platform toward shadow AI.

Does Veraify block personal AI accounts while allowing the corporate tenant?

Cloudbrink has not published whether Veraify separates personal from enterprise accounts on the same AI service, so verify it directly. dope.security does make that split on the device, allowing corporate ChatGPT while blocking personal ChatGPT on the same domain, which is the control that lets people keep a sanctioned tool without leaving the personal side open.

Is a standalone shadow-AI tool enough, or do I still need a secure web gateway?

Shadow AI is web traffic and file movement, which a secure web gateway already inspects. A standalone AI tool on top of a separate gateway is two agents and two consoles. dope.security runs discovery, account control, and prompt DLP inside the same on-device agent as the SWG, so it is one deployment and one policy model.

How does dope.security classify sensitive data in AI prompts?

Dopamine DLP extracts the text on the device and classifies the prompt and any attachment by meaning, catching PII, PCI, PHI, and intellectual property with far fewer false positives than regex rules, then blocks the sensitive ones before they leave. Classification uses an LLM with zero data retention.

How much does dope.security cost compared to Veraify?

dope.security publishes pricing on its website and offers a free production trial, so you can measure value before committing. Veraify pricing is not public at launch. Transparent pricing matters more in AI governance because the usage you are trying to control grows every quarter.

Which AI surfaces does dope.security cover?

dope.security inspects traffic on the device, so it sees AI usage in the browser, in desktop apps like ChatGPT and Claude, in IDEs, and in CLIs, plus MCP connections, and enforces policy across all of them from one console.

Bottom line: discovery is now the price of entry, and Veraify brings it to the endpoint where it belongs. The control that actually stops a leak is the account-level split and the on-device prompt DLP that follow discovery, and dope.security ships both in the same agent that runs your gateway.