AI Usage Overview

The AI Usage Overview shows which AI services are in use across your devices, whether usage is growing, and how many devices use each service. It gives IT and Security teams evidence of which AI tools employees are using, for reporting to leadership, Finance, auditors, or customers. It uses DNS query data that DNS filtering already collects.

The overview is in the Admin Console under Internet Security > Secure DNS.

Controls

There are three controls at the top of the overview:

• Time range: select 7, 30, or 90 days.
• Queries / Devices toggle: switch all counts between total DNS queries and total unique devices.
• Profile scope: limit the data to devices assigned to a specific DNS filtering profile.

AI Usage by Date

This chart shows daily AI activity across all AI services, based on the selected Queries or Devices metric.

AI Exposure

This half-donut chart shows AI activity as a share of all DNS activity, with the raw counts below it. With Queries selected, it compares AI queries against total queries. With Devices selected, it compares devices with AI activity against all devices with any DNS activity through DNS filtering in the selected time window.

Top AI Services

This list ranks AI services by the selected metric (queries or devices). Each row shows the service name and logo, a colored dot for the service’s category, and the query or device count. Hover over a row to see the full category name, the days active count, and the service’s percentage of all AI queries or devices.

Expand a row to see the domains that matched the service and the request count for each domain. Select “Show all AI services” to see all services with activity in the window.

Device count shows how widely a service has spread, query count shows how heavily it’s used, and days active shows whether the activity was recurring or was a one-time visit.

AI Usage Summary Report

Between AI Exposure and Top AI Services, select Generate Report to create an AI Usage Summary report.

The report is a companion to the overview. It maps each device to the AI services it made DNS requests to, giving you the device-level detail behind the overview’s totals. The report contains one row for each device and service combination.

Column	Description
device_id	The device identifier. For devices that connect with a Machine Key, this value comes from the hostname. Otherwise, this value is the Twingate device ID.
device_name	The human-readable device name.
ai_service	The canonical service name, for example OpenAI ChatGPT or Anthropic Claude.
category	The service category, for example Developer platforms, General purpose assistants, or Coding tools.
total_requests	The total number of DNS requests from this device to the service’s matched domains in the time window.
days_active	The number of distinct days in the window with at least one matching request.
first_seen	The timestamp of the first matching request in the window.
last_seen	The timestamp of the most recent matching request in the window.
top_10_domains	Up to 10 of the most-requested domains from this device for this service.

Common Uses

• Report to leadership or auditors which AI services appear on devices covered by DNS filtering.
• Spot categories where several services appear, such as meeting notetakers, as candidates for consolidation.
• Compare observed activity with license or procurement records.
• Check whether existing DNS filtering rules cover the domains you expect.
• Use the AI Usage Summary report to identify specific devices to contact.

How Usage Is Counted

The overview tracks two kinds of AI service: general-purpose assistants such as ChatGPT and Claude, and AI-native tools such as Granola and Cursor. Both are services where company data can end up in a vendor’s model, and where employees can start using them without approval. AI features added to an existing product are not tracked. That traffic rarely appears separately in DNS, and the feature usually comes provisioned through the parent product.

• A query is counted when a device makes a DNS request to a domain associated with an AI service.
• Requests blocked by your DNS filtering rules are not counted.
• Devices are counted by Twingate device ID. However, devices that connect with a Machine Key can share one device ID. In this case, devices are disambiguated using hostname. If no hostname is available, the device ID is used.
• Treat device counts as a measure of how many devices make requests to a service, not as a precise user count.
• DNS activity is matched to AI services via a reviewed list of AI services and their domains. Recently launched services may not appear until they are added to the list. You can view the full list of tracked AI services by selecting View the full list with usage definitions in the overview.

Limitations of DNS-Based Visibility

DNS activity is useful evidence of AI usage, but it has limits:

• The overview shows only the DNS traffic that Twingate resolved. We recommend configuring your Clients to always run Internet Security, even when a user is signed out, by deploying a Machine Key. See Internet Security Client Configuration for more information.
• A high request count does not necessarily mean that a person spent a lot of time using a service. Some apps and websites make DNS requests automatically in the background, and these count the same as deliberate use.
• AI services change their domains from time to time. If a service moves traffic to a new domain, the overview can undercount its usage until Twingate updates the service taxonomy.