iboss AI Security Platform: What the Free AI Add-On Covers, and Where It Stops

iboss gave away an AI Security Platform for free in July 2026, and it is a real product, not a press release. It captures prompts and responses across ChatGPT, Copilot, Gemini, Claude and Perplexity in the browser and in desktop apps, detects personal-account sign-ins, and can block pastes and uploads. That is a genuine step. The honest question for a security team is narrower: is a browser-and-desktop AI add-on bolted onto a cloud-proxy SWG the same as governing AI natively on the endpoint, across every app and every network? It is not. dope.security runs AI discovery, DLP and tenant control on the device itself, so the governance does not depend on which browser someone opened or whether they were routed through a point of presence first. If you are weighing the two, start with our iboss alternative breakdown and then come back here for the AI-specific details.

This post looks at what the iboss AI Security Platform actually covers, where iboss itself leaves the depth undisclosed, and why the architecture underneath still matters more than the feature checklist.

What the iboss AI Security Platform covers

Give iboss credit. The free AI Security Platform, launched in July 2026, is not the old 'DNS can see the domain, good luck' story. Per iboss documentation, it claims prompt and response capture across the major assistants, coverage inside desktop apps like Cursor, detection of personal-account sign-ins, prompt and upload and paste blocking, and a default-deny posture for AI agents. iboss also shipped an AI-powered SSPM in January 2026 and an AI-CASB on March 23, 2026, so the company is clearly investing in the category.

So the gap is no longer 'iboss has no AI controls.' That framing is out of date, and we are not going to use it. The real gap is maturity and architecture, and iboss has left the most important parts undisclosed.

Where iboss stops: semantic depth and enforcement maturity are undisclosed

Here is what iboss has not published. The semantic depth of its prompt inspection is not documented. There is a difference between matching a keyword or a regular expression in a prompt and actually reading the meaning of what someone pasted. iboss has not shown which one it does, and the AI-CASB that underpins a lot of this only arrived in March 2026, so the enforcement model is young. When a vendor stays quiet on how deep the inspection goes, treat the depth as unproven until they show it.

Gartner noted in 2025 that iboss focuses on the secure web gateway over SaaS breadth and ships few API integrations. That matters for AI governance, because governing modern AI use means reaching into tenants, desktop clients, IDEs and command-line tools, not just the web path. A browser-and-desktop capture layer is a start, but it is still a layer added on top of a product built to be a cloud proxy first.

The architecture underneath: a cloud proxy with points of presence

iboss runs dedicated, containerized, per-tenant gateways across roughly 100-plus points of presence. That is the classic cloud-proxy model: traffic is steered to the nearest iboss gateway, inspected there, and sent on. Everything the AI Security Platform does still rides on top of that steering for the web path. The AI capture in desktop apps is a separate agent capability, but the web and SaaS governance inherits the proxy's detour.

dope.security took a different route. We moved the proxy onto the device. SSL inspection, URL filtering, Cloud Application Control and AI-powered DLP all run locally through the Fly Direct secure web gateway, and policy lands on every endpoint in under a minute. There is no gateway to route to first. If you want the full architecture contrast, our write-up on endpoint-based SWG versus cloud proxy SWG walks through it.

What the detour costs you

Any cloud-proxy SWG, iboss included, adds a network detour to the web requests it inspects. Every request goes to a point of presence and back. Measured cloud-proxy latency runs about 40 to 80 ms when a user sits near a gateway and 150 to 400 ms when they do not, and AI assistants are chatty, so the tax compounds across a working day.

See the detour for yourself. The Fly-Direct Speed Test measures your real round-trip latency in the browser and shows, app by app, how pages would load flying direct on the device versus taking the proxy detour to a data center and back. Run it, then see how Fly Direct works or book a 20-minute demo.

On-device inspection adds no network detour, which is how dope.security delivers up to 4x the performance of legacy proxy SWGs.

AI governance as a foundation, not an add-on

This is the heart of it. iboss added AI controls to a secure web gateway. dope.security built AI governance into the platform as a native layer, not a separately announced product family. We run three layers that work together: Shadow IT and shadow AI discovery that shows every AI app in use, SWG policy that allows, warns or blocks, and Cloud Application Control that restricts access to your enterprise tenant while blocking the personal account on the same domain.

That last move is the one most architectures struggle with. Allowing corporate ChatGPT while blocking personal ChatGPT on the same domain needs an HTTP header inspected and acted on inside decrypted TLS. dope.security does it on the device. Underneath the governance sits Dopamine DLP, our AI-powered endpoint DLP. It reads the meaning of a document or a prompt rather than matching patterns, classifies with zero data retention, and blocks sensitive uploads to the web and to AI tools. It carries US Patent 12,464,023. You can see the broader approach in our overview of one-click AI blocking and shadow AI detection.

iboss versus dope.security on AI governance

Here is the head-to-head, feature by feature, with iboss first and dope.security second on each line.

• Discovery: iboss discovers AI use through its browser and desktop capture layer; dope.security discovers every AI app, sanctioned or not, from the endpoint with no proxy logs to grep.
• Prompt inspection: iboss captures prompts and responses but has not disclosed the semantic depth; dope.security reads the meaning of prompts and attachments on the device with Dopamine DLP.
• Personal versus enterprise accounts: iboss detects personal-account sign-ins; dope.security blocks the personal account and allows the enterprise tenant on the same domain, from one screen, live on every endpoint.
• Architecture: iboss rides a cloud proxy across 100-plus points of presence; dope.security inspects on the device with no backhaul, under 100 MB of RAM.
• Maturity: iboss built its AI-CASB in March 2026 and its enforcement depth is young; dope.security ships AI governance as a native layer, not a bolt-on.

Both products discover AI. The difference is whether governance is a capability added to a proxy or a property of where the inspection runs.

What about China and distributed teams?

iboss operates points of presence in China, but customers report connectivity weakness there, and a cloud-proxy model is only as good as the nearest reachable gateway. dope.security inspects on the device on any network in any country, which is why it holds up for distributed teams and travelers without a paid regional uplift. One Fortune 100 customer scaled dope.security from 900 devices to more than 18,000 in a matter of weeks, averaging roughly 3,000 per week, because there was no gateway topology to design first. Read how that 18,000-device deployment actually ran.

So, do you need the iboss AI Security Platform?

If you already run iboss and want basic AI visibility at no extra cost, the AI Security Platform is a reasonable thing to turn on. It is a real capability. But 'free add-on to the proxy you already have' is a different proposition from 'AI governance built into the platform from the start.' The browser-and-desktop capture is a layer. The point-of-presence detour is still there. The semantic depth is undisclosed. If AI governance is the reason you are shopping, the architecture you buy matters more than the checkbox, and governing AI on the device beats governing it at a gateway you have to reach first.

Frequently Asked Questions

Is the iboss AI Security Platform free?

Yes. iboss launched the AI Security Platform as a free product in July 2026, covering prompt and response capture across major assistants in the browser and desktop apps, personal-account detection, and prompt, upload and paste blocking. It is a genuine capability, though iboss has not published how deep its semantic prompt inspection goes. dope.security includes AI governance as a native layer of the platform rather than a separate free add-on.

Does the iboss AI Security Platform replace a secure web gateway?

No. It is an AI-focused capture and control layer that runs on top of the iboss secure web gateway and its cloud-proxy architecture. You still run the underlying proxy and its points of presence. dope.security combines SWG, Cloud Application Control and AI-powered DLP in one on-device agent, so AI governance and web security are the same product, not two layers.

Can iboss block personal ChatGPT while allowing corporate ChatGPT?

iboss detects personal-account sign-ins, but separating a personal account from a corporate account on the same domain requires inspecting and acting on an HTTP header inside decrypted TLS. dope.security does this on the device through Cloud Application Control, allowing the enterprise tenant and blocking the personal account from the same screen, with policy live on every endpoint instantly.

Does iboss add latency to AI traffic?

For the web path, yes. iboss steers traffic to one of roughly 100-plus points of presence for inspection, which adds a network detour measured at about 40 to 80 ms near a gateway and 150 to 400 ms when users are far from one. dope.security inspects on the device and adds no network detour, delivering up to 4x the performance of legacy proxy SWGs.

What is the best iboss alternative for AI governance?

dope.security is the on-device alternative. It discovers every AI app from the endpoint, reads prompts and attachments with Dopamine DLP at zero data retention, and enforces enterprise-only access through Cloud Application Control, all without backhauling traffic to a gateway. For the full comparison, see our iboss alternative guide.