Before
Security and compliance teams had to retrieve usage data from Zscaler and Netskope separately, compare it manually with the ServiceNow register, and identify unregistered tools or enforcement gaps. They then had to update records, notify affected users, and initiate qualification or policy-restoration actions through separate handoffs.
How it works
- Collect the last 24 hours of AI-tool usage and compare it with the registered tools, stopping updates when neither usage source is available.
- Create and route new-tool discoveries for qualification and user notification, while updating daily usage details for known tools.
- Detect mismatches between recorded decisions and observed enforcement, send them for policy reapplication, and return the daily results summary.
Workflow details
- Daily collection: At 6:00 AM Europe/Paris, the workflow retrieves AI-tool activity from the previous 24 hours through Zscaler and Netskope, then reads the known-tool register in ServiceNow. If both usage sources are unavailable, the register remains unchanged so an outage is not mistaken for zero usage.
- Usage reconciliation: The workflow compares observed tools with registered tools and classifies them as new, known, or potentially out of alignment. For known tools, it records the daily user count, personal-account usage, DLP alerts, activity sources, and most recent detection.
- New-tool qualification: Newly observed tools are added to the register with a discovered status and their current usage details. The workflow then launches the qualification process, including the defined assessment and review path, while notifying affected users that the tool is under evaluation and providing the internal alternative.
- Policy alignment: For registered tools, the workflow checks whether observed traffic and enforcement states match the recorded decision. Detected mismatches, such as allowed traffic for a blocked tool or inconsistent Zscaler or Netskope enforcement, are sent to the policy reapplication process; the automation does not make a new blocking decision by itself.
- Daily operational result: The flow updates the registry, routes discoveries and enforcement issues to the appropriate downstream processes, preserves human approval by the RSSI and DPO where required, and returns a daily summary containing discovered tools, detected drift, and processing results.
What changed
Every morning, the comparison, classification, record updates, notifications, qualification handoffs, and drift checks occur automatically. Human RSSI and DPO approvals remain the decision point for qualification, while policy mismatches are routed for reapplication without the flow making a new blocking decision.
Work removed
Manually pulling usage from two security gateways, cross-referencing it with the tool register, updating daily usage fields, creating discovered-tool records, notifying affected users, initiating qualification reviews, and checking and reapplying policies that have drifted.
Expected outcome
An estimated 15–30 minutes of daily analyst preparation is removed, with new AI tools consistently recorded and routed for review and known-tool policy drift surfaced for action.
