Passive AI-Service Detection with Zeek: Architecture and Detection Limits
How we built agentless shadow-AI detection from mirrored network traffic — the capture architecture that took two attempts, the sensor that died quietly, and an honest accounting of what passive detection can and cannot see.