How Lawgistics found 1,000 hours of unapproved AI use in its clients' browsers

Lawgistics is a managed service provider focused on law firms that range from 40 to 400 endpoints each. Sean Anderson, the firm's Technical Innovation Manager, owns new technology evaluation: testing platforms, building the policies that govern them, and deciding what reaches client environments.

That role has shifted almost entirely toward AI. Anderson's work now centers on configuring, restricting, and testing AI tooling so that law firm clients can use the tools without putting confidential data at risk. Atakama joined the Lawgistics stack three months ago to supplement existing endpoint security, MFA, and platform hardening.

The browser was the one layer Lawgistics could set policy on but could not watch.

Lawgistics had worked methodically down its security stack. Endpoint protection was locked down, MFA was enforced across platforms, and the SaaS tools its client firms depend on were hardened. Intune handled browser policy and Microsoft Defender covered basic DNS filtering. What none of that provided was an active view of what was actually happening in the browser, where all users spend the overwhelming majority of their time.

That gap became increasingly consequential as more SaaS applications moved into the browser.

For law firms, the risk of unmonitored browser activity is concrete rather than theoretical. A user pasting case material into a personal AI account is not an abstract policy violation. It is client information sitting in a third party's system, on a matter with an opposing party, a likely violation of the attorney-client privilege.

A policy set built in 45 minutes and deployed through tooling Lawgistics already ran.

Anderson came across Atakama, a browser security platform, in a hallway conversation at a conference in Denver, then sat in on the demo running at the event.

Deployment went through Intune, the same path Lawgistics uses for everything else it rolls out. Most of the effort was decision-making rather than implementation: reviewing the available controls and deciding which ones belonged in a law firm environment. The initial policy set took about 45 minutes to build and deploy and covered sensitive-page watermarking, malicious content blocking, and warnings for weak, compromised, and reused passwords.

Anderson has since expanded his original policy set to cover upload and paste blocking, a capability that was still on the roadmap when Lawgistics first deployed and quickly shipped after they joined.

Extension management that reads in plain English.

Extension management in Intune presents extensions as long alphanumeric identifiers, which makes reviewing them slow. Atakama lists them by name with immediately recognizable icons.

Shadow AI found, unapproved file sharing surfaced, and client conversations that start from data.

Shadow AI, quantified. Lawgistics found one client with a single user logging 112 hours a month on ChatGPT, which Lawgistics had not approved. Across the environments Anderson manages, browser data showed 38 users accounting for roughly 1,000 hours of ChatGPT in a single month.

Unapproved sharing tools identified. Activity data surfaced ShareFile in use at a client, despite not being on the approved list of sharing platforms.

A baseline of normal. For most clients, the data confirmed what Anderson expected to see: case management software, Zoom, and a smaller group in QuickBooks. That baseline is what makes the exceptions stand out.

AI conversations grounded in numbers. Anderson can now open a licensing and governance conversation with a client using real usage data instead of a general warning about risk.

Those findings are shaping what comes next. Anderson has written an expanded AI policy that limits access to the platforms Lawgistics has configured for clients and allows ChatGPT for research while blocking uploads and pastes to it, and browser data is being brought into the account management team's quarterly reviews with clients.