Turn AI website policy into an enforceable control
Matthew Miller
Product Marketing Manager
Trusted by 3,000+ MSPs worldwide
The challenge
Move from an AI policy document to tested website access decisions.
The problem
Employees can reach AI websites the customer has not approved, while the MSP is asked to enforce a policy that may not name the tools, owners or exceptions.
Why it happens
AI adoption moves quickly, and a policy document does not itself control destination access. Office networks and remote devices may also have different protection coverage.
If it stays unresolved
The customer lacks a consistent route to approved tools, and the MSP cannot show where its access policy is enforced or how justified exceptions are handled.
How the products help
DNS Security, delivered through CyberSentriq Web Protection, applies supported domain and content policies to covered destination requests. Central management, directory integration and custom block pages can help the MSP apply and explain those decisions. The MSP agrees an approved-tool list, tests rules across the actual deployment and manages exceptions. Machines Backup, Microsoft 365 Backup and, where relevant, Google Workspace Backup can protect eligible work saved outside an AI application; they do not govern AI prompts. DNS Security controls destination access, not data entered within an allowed tool.
Give AI access policy a business owner
The difficult part of Shadow AI governance is deciding which tools the business permits and who can approve an exception. An MSP can turn those decisions into a service: maintain a customer-approved destination list, apply supported DNS policies, test office and remote coverage, and review blocked requests and exceptions with the policy owner. The control remains useful as the customer's tool choices change.
This also sharpens the conversation about visibility. A DNS decision can show that a covered device requested a destination and whether policy allowed it. It cannot reveal the prompt, uploaded file or action inside an allowed AI application. If a customer needs that level of oversight, record it as a separate requirement. The MSP earns credibility by defining the scope of the deployed control and giving the SMB a workable path to approved AI use.
Define the customer's approved destinations
Start with the tools the business intends to use, the destinations it wants to restrict and the people who can approve exceptions. Translate those decisions into supported domain or content policies, and test the named destinations. This gives employees a clearer route to approved tools and gives the MSP a policy it can demonstrate.
Email Protection Built for MSPs
of spam, malware and malicious email blocked before it reaches the inbox
MSPs worldwide trust CyberSentriq to protect their customers
each user receives a unique, randomised phishing simulation
of cybersecurity expertise behind the CyberSentriq platform
Apply rules to the covered workforce
Configure and test protection for the relevant networks and devices, including remote working where supported. Directory integration can help assign policies to the applicable users or groups; custom block pages can explain an access decision. Establish a process for legitimate exceptions. A DNS control governs access to a destination; it does not inspect the prompt or file a user submits inside an allowed AI application.
Review the evidence and refine the policy
Use available DNS reporting to discuss blocked requests, requested exceptions and coverage gaps. Combine that evidence with the customer's inventory of approved tools and an education process for employees. The result is a manageable review cycle grounded in the access decisions your service can actually observe and enforce.
An unapproved AI destination in practice
A department begins using a public AI website that is outside the customer's approved-tool list. The MSP confirms the business policy, configures a destination rule and tests it on covered office and remote devices. If a team has a legitimate need, it follows the agreed exception process rather than working around a silent block. At the next review, the MSP can show the policy result and any exceptions. DNS events show destination requests, not the text employees entered into an approved AI tool.
