Most organizations discovered their shadow IT problem the same way they will discover their shadow AI problem: after the fact. Field Effect is making a different bet. Its new AI Detection and Response (AIDR) capability, launched June 9, 2026 and built into the company's managed detection and response (MDR) platform, argues that the moment to see AI activity in an organization is not quarterly during a governance review, but continuously, at the network and endpoint layer, in the same stream where threats are already being tracked.

The conventional assumption in most AI governance conversations is that visibility is a policy and procurement function. Bring the chief information officer and chief information security officer together, define an approved tools list, push it through acceptable-use policy, and enforce via browser filtering. On paper, that works. In practice, Field Effect's own 2026 customer data shows 93% of organizations have either knowingly or unknowingly adopted AI, and 59% of employees report doing so without IT or security oversight (Field Effect; 2026). You cannot govern what you have not seen, and policy mechanisms are not fast enough to keep up with the rate of adoption.

The architecture is the argument

AIDR is not a standalone AI governance tool bolted onto a security platform. It is delivered as a native capability inside Field Effect MDR, which already monitors endpoint, network, cloud, and Domain Name System (DNS) activity. Understanding what an AI application is doing inside an organization requires correlating signals across those four layers simultaneously, and you need both to know what is actually happening.

Field Effect founder and chief executive Matthew Holland made this point directly in the launch announcement: building AI Detection and Response in isolation is not possible. The capability to understand AI behavior inside an organization depends on visibility that a siloed AI governance tool cannot provide by itself.

The product itself organizes around three capabilities: illuminating shadow and rogue AI tools across the environment; surfacing risk by showing what data sources and Model Context Protocol (MCP) servers those tools are connecting to; and enforcing governance controls in-browser and on-device in real time. The MCP server visibility detail is notable. As enterprises begin building internal AI workflows that connect large language models to internal data systems through MCP, the attack surface expands in ways that traditional endpoint detection does not cover. Field Effect's claim is that its network and DNS telemetry positions AIDR to catch those connections.

Who this is built for

Field Effect distributes primarily through managed service providers (MSPs), and AIDR is available as part of the MDR platform for that channel. Most mid-market and lower-enterprise organizations do not have dedicated AI governance staff. They rely on MSPs to manage security. Putting AI visibility in the hands of MSPs means the organizations that most lack dedicated resources are also the ones most likely to receive coverage through a service they already buy.

Field Effect's advantage is depth of security telemetry. AIDR keeps the product anchored to that strength, giving MSPs a way to extend AI governance to clients without requiring a separate purchase or a new vendor relationship.

Governance without a governance budget

The larger context here is that AI governance has become an unfunded mandate for most organizations. Regulatory pressure is real, whether through data protection frameworks in Europe, sector-specific rules in financial services and healthcare, or emerging liability exposure around AI-generated outputs. The budget to build dedicated AI governance programs has not materialized at the same rate, particularly below the enterprise tier.

Security budgets, by contrast, are already committed. MDR contracts are multi-year and already funded. When AI visibility rides inside an existing MDR contract rather than requiring a new purchase, adoption friction drops significantly, and organizations that lack a dedicated AI governance budget can still get coverage.