Jump to a page or a control
Protect · Managed tier · Data Protection
Traffic to AI model providers is inspected for sensitive data, and only approved AI services are reachable.
Status
Gap1 item contradicts the control.
Exposure
High
2 evidence items from 1 sources
CCSA · Protect
Below FoundationalNot blocking this domain's next tier.
Outbound inspection does not cover model-provider endpoints, so prompts are not checked for customer data.
Remediation · Data Protection
Add model-provider domains to the decryption and DLP profile, or allow AI traffic only through the gateway.
Root cause: Unobserved AI. A branch assistant calls a model provider directly, outside the gateway.
Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.
ev-pr09-1
18,422 sessions to model providers in 7 days, none inspected
Palo Alto Networks Panorama · telemetry · collected 3 h ago (Oct 15, 2026 · 10:59 UTC) · limit 48 h
Powered by Mesh APIshow log traffic dst in model-provider-edl decrypted eq no last 7d4f84f6ab6336f996514313a001e165bc37fa98c2682e15b70c0608eeffb77e7fev-pr09-2
Gateway traffic is decrypted and checked against the bank's DLP profile
Palo Alto Networks Panorama · config · collected 3 h ago (Oct 15, 2026 · 10:59 UTC) · limit 48 h
show running decryption-policy · show log data profile BANK-PII last 7d84ef367fdf16babd445bea96d707feecde22444d23ca061b78689f72e40aa3bd