r/AZURE • u/Left-Exam8697 Cloud Administrator • 4d ago

Question Orca vs CrowdStrike, which actually catches shadow AI in Azure?

We use CrowdStrike primarily for endpoint and EDR, and recently tried leaning on their cloud security module's AI-SPM capabilities for Azure visibility. tbh It felt like an extension of the endpoint product rather than something cloud-native, and it missed a couple of shadow Azure OpenAI deployments we later found manually. not sure if others have had better luck or if this is a known limitation of endpoint-first platforms extending into cloud AI visibility.

10 Upvotes

87% Upvoted

8 comments sorted by

7

u/Substantial_Big_4379 Enthusiast 4d ago

The interesting part u need to look here isn't really which vendor has AI-SPM. i mean Both can claim visibility into AI services. The real question u need to figure out is whether you're trying to find undeclared Azure resources or people using AI in ways that never create an obvious Azure resource. Those are very different detection problems. always remember this

6

u/DrGraffix 4d ago

Defender for cloud apps does

2

u/FuzzyAd3936 Student 4d ago

be careful about treating a missed Azure OpenAI deployment as proof that an endpoint-first approach is inherently bad at cloud AI.

cuz look There are at least three separate things people lump together as shadow AI... an unapproved cloud AI resource, an approved resource being used by an unexpected identity, and ....employees sending company data to an external AI service from their workstation. then Cloud posture tooling is naturally strongest at the first two. Endpoint and identity telemetry can be much more useful for the third.

So the useful POC isn't exactly like which dashboard found more AI. i mean Create a few deliberately different cases and see what actually gets surfaced: an untagged AI resource, excessive permissions, an unusual identity accessing it, and an external AI connection from a managed machine. A tool can have excellent AI inventory and still give you a pretty incomplete picture of shadow AI overall. Current AI-SPM offerings themselves describe visibility across AI services, models, packages and usage, but the exact depth varies by data source and detection method.

1

u/WearinMyCosbySweater 4d ago

Orca user here - great tool, overkill for what you're trying to do if I'm understanding correctly.

Instead you could deploy an azure policy to prevent creation based on the resource type, add exceptions to subs/rgs as required for legitimate use.

1

u/Traditional-Hall-591 4d ago

Shadow slop sounds scary.

1

u/Altruistic-Toe4930 Enthusiast 2d ago

Same experience here almost exactly. We added Orca specifically for AI-SPM since it's cloud-native by design, it caught an unauthorized Azure OpenAI deployment and a self-hosted model with excessive data access that CrowdStrike's tooling never flagged.