Gigamon unveils tools to track shadow AI across networks

Gigamon has introduced new software and hardware features to help security and IT teams track and govern AI activity across distributed environments. The launch focuses on visibility into generative AI and large language model traffic, including unsanctioned use.

The update extends the company's Deep Observability Pipeline with a new GigaVUE-GSA110 network appliance and additional Gigamon Application Metadata Intelligence features. The system is intended to give organisations more detailed information about how applications, services, users, agents and AI models interact across public cloud, private cloud and on-premises infrastructure.

The move comes as companies increasingly adopt what Gigamon describes as Hybrid AI, using a mix of frontier, open-weight, specialised and private models in different environments to meet cost, data and governance requirements. That trend is creating a more fragmented technology estate for security and network teams to monitor.

One of the main operational issues is the rise of shadow AI, where employees or systems use AI tools outside approved channels. The new features are designed to identify and classify GenAI and LLM application traffic so organisations can distinguish between sanctioned and unsanctioned use.

New appliance

At the centre of the announcement is the GigaVUE-GSA110, a 1RU network appliance that adds what Gigamon calls distributed GigaSMART processing alongside its existing visibility products. The appliance supports Application Metadata Intelligence processing across up to 400 Gbps of network traffic and optimised packet delivery for up to 800 Gbps.

Its disaggregated design allows customers to add processing capacity where needed, rather than expand infrastructure uniformly across a network. In practice, that means teams can place additional traffic processing closer to workloads or environments where demand for AI-related monitoring is rising.

Gigamon's Application Metadata Intelligence software converts network traffic into application-level context that can be exported to security, observability, data and AI systems. This metadata can show application identity, relationships, dependencies, protocol behaviour and certificate activity.

The update also changes HTTPS metadata handling by combining two records into one unified record, reducing metadata records for those flows by about 50 per cent while retaining application context.

Hybrid AI

The broader issue for infrastructure suppliers is that enterprise AI is shifting away from a single-model approach. Many organisations are expected to use different AI models and services for different tasks, balancing sovereignty, performance, governance and cost requirements.

Gigamon cited a Gartner forecast that by 2028 more than half of enterprises will use public cloud selectively for bursty or experimental workloads while keeping performance-sensitive and sovereignty-sensitive AI workloads in private or localised environments. That would leave many security teams managing AI workloads and data flows spread across several operational domains at once.

Against that backdrop, vendors are trying to offer tools that reveal not only the underlying infrastructure but also the traffic patterns and dependencies created by AI applications and agent-based systems. As AI systems become more interconnected with enterprise applications and services, security teams face a growing challenge in understanding how automated actions move across a network.

Gigamon's approach is to provide network-derived telemetry that can be passed on in formats including JSON, CEF and IPFIX to downstream tools and platforms. This flexibility is intended to support existing workflows as well as analytics and AI systems.

Executive view

Gareth Maclachlan, Chief Operating Officer at Gigamon, said AI-related network visibility is becoming a more pressing issue as organisations distribute workloads across different environments.

"Hybrid AI and agentic workflows will fundamentally change how enterprises operate and secure increasingly distributed infrastructure," said Gareth Maclachlan, Chief Operating Officer at Gigamon.

"As network and security operations become more AI-enabled, they need consistent, trusted network context to analyze activity and make informed decisions. The GigaVUE-GSA110 extends the Deep Observability Pipeline with distributed processing capacity and application intelligence at scale, helping organizations investigate issues faster, strengthen governance, and build a stronger foundation for AI-enabled operations," Maclachlan said.

Gigamon said the GigaVUE-GSA110 appliance and the new Application Metadata Intelligence enhancements are available now.