The Problem
AI and ML tools spread faster than any inventory can track — Cursor, Claude Code, Ollama, Jupyter, vector databases — and each one can ship sensitive data to third-party APIs. Vulnerability scanners weren't built to see "AI risk," so shadow AI accumulates invisibly until an auditor, or an incident, finds it first.
What It Does
Pythia discovers shadow AI by content, classifies it by role, and governs where its data flows. It sweeps five evidence sources, classifies each find — Model Serving, Vector/RAG, GPU/Training, MLOps, LLM client, AI Dev Tool — flags exposed endpoints (often unauthenticated), correlates KEV exploitability, and separates sanctioned from shadow data egress via an editable allowlist.
Key Capabilities
- 5-source discovery — sweeps the AI plugin family, software inventory, CPEs, and plugin output into one AI asset list that catches what any single source misses.
- Role classification + per-role ACR — every find typed as Model Serving, Vector/RAG, GPU/Training, MLOps, LLM client, or AI Dev Tool, with matching criticality.
- Exposed-endpoint and unauthenticated detection — flags the AI services reachable right now, often with no authentication.
- Data-egress governance — detects egress capability and configured destinations, split sanctioned vs. shadow by an editable allowlist.
- "Why?" evidence inspector + FP suppression — every detection shows its evidence, and false positives can be suppressed.
- MITRE ATLAS mapping + gated "AI" tags — findings carry adversary-technique context and become human-approved, routable tags.
How It Works
Pythia runs against the local navi.db built from your Tenable data: the vulns AI plugin family and output, plus the software and cpes inventories, with a browser fetch of the MITRE ATLAS catalog. All writes are proposed, human-approved, and logged.
Who It's For
AI governance and risk teams who need a defensible inventory; security architects deciding what to sanction; CISOs answering "how much AI do we run, and where does its data go?"
Proof Points
In a reference environment of 268 assets, Pythia surfaced 29 assets via the AI plugin family plus 15 additional AI-native apps found only through CPE evidence — invisible to plugin-only detection. Egress findings are capability plus configured destinations, not proven exfiltration; blind or uncredentialed hosts are called out, not hidden.
Works Better With
Pythia feeds Fenrir — an exposed, unauthenticated AI endpoint is an attack-path entry — and Anubis, which turns per-role ACR suggestions into calibrated criticality. It shares the KEV signal with Laelaps.