The best part is that I don't have to guess anymore. I don't come from a security background, but I have admin access and I can see which AI tools people use and what kind of data goes into them. Our teams work in Claude, Gemini through Google Workspace, ChatGPT for images and Dust. Cerbera covers all of them, plus whatever people try on the side with a personal account. When something gets flagged, most alerts come with a plain explanation of what happened and a suggested rule. I can take that straight to our CTO and CISO and we decide together, instead of me forwarding logs I only half understand. Review collected by and hosted on G2.com.
A few alerts are still written for engineers. When one mentions a process or a technical detail I don't recognise, I need to ask our CTO what it means before I can follow up with the person. It doesn't happen often, but a simpler wording for non-technical admins would help. Review collected by and hosted on G2.com.