How To: Enabling Safe GenAI Access on Unmanaged Devices and Corporate Wi-Fi

Generative AI (GenAI) tools such as ChatGPT, Claude, and GitHub Copilot have become integral to the workplace and are used by employees as productivity tools. Banning new tech doesn’t work; it drives adoption underground and fuels shadow IT. The genuine threat isn’t the tool, but in the supporting device and network configuration.

Organizations should transition from static content filters to trust-based access, regulating who may utilize these tools, on which devices, and under what compliance conditions. By linking GenAI access to user and device identification, organizations may achieve an optimal harmony between security and innovation.

Why Blocking GenAI Tools Doesn’t Work

GenAI tools are now thoroughly integrated into employee workflows, including corporate Wi-Fi, VPNs, browsers, and personal mobile devices. Bring Your Own AI (BYOAI) tools may boost productivity, but without visibility and control, they open the door to serious security and compliance risks. According to a CDO Magazine survey, 58% of organizations are already juggling more than five GenAI tools, often without consistent oversight.

GenAI is meant to be available to everyone, but traditional network controls can’t keep up. ChatGPT and Claude are cloud-native tools that are frequently updated and accessible over encrypted HTTPS. It is nearly impossible to tell the difference between GenAI traffic and standard online surfing. Users may easily bypass restrictions via VPNs, personal hotspots, or unmanaged devices, even if you block domains or browser plugins.

Blocking doesn’t fix the problem; you don’t control the device or person making the request. The perimeter model determined trust by being “on the network.” However, GenAI challenges this model since users may access it from anywhere, using tools you can’t see, which might put sensitive data at risk.

Shift the Control Point to the Device

Organizations should only let people use GenAI tools on safe and trustworthy devices to lower risk. This involves ensuring that the organization owns the device or is approved for work and managed using an MDM or similar tool.

Devices should also have the latest operating system and security updates to help block threats and prevent hackers from stealing data or interfering with GenAI usage.

Tools like Microsoft Defender or CrowdStrike should be active to find malware or unusual activity, including applications that try to capture what you type or view during a GenAI session. Organizations may eliminate damaging GenAI use before it starts by ensuring each device is safe, not just the network. This helps identify risks promptly, such as:

• Keyloggers capture passwords and confidential prompts typed into a GenAI tool.
• Screen capture virus quietly saves GenAI-generated designs, code, or business ideas.
• Remote control flaws enable hackers to alter GenAI queries and steal real-time results.

Access should be denied immediately if a device fails these posture checks or cannot be verified as trustworthy. This proactive approach implies that security choices are based on device health and compliance, rather than brittle URL filters or reactive blocks. A more robust, adaptable security posture safeguards important data while allowing employees to use GenAI tools from certified, secure devices.

Enforce Trust with Certificate-Based Authentication

Given the growing use of GenAI tools across several devices and places, verifying that each device is trusted before allowing access is crucial. Organizations can use certificate-based authentication to check a device’s identification and posture instead of relying on passwords or user-based controls. This approach assures that only approved, secure devices may interact with company resources, including GenAI platforms.

Unlike passwords or tokens, certificates are cryptographically connected to both the user and the device’s identities. They are not exportable, which means they cannot be duplicated or used on unauthorized devices. Certificates are only granted to devices that match preset security criteria, such as enrollment in a Mobile Device Management (MDM) platform like Intune or Jamf and active endpoint protection from tools like Microsoft Defender or CrowdStrike.

With SecureW2, certificates are only issued after completing these posture tests. From there, SecureW2’s Cloud RADIUS authenticates and enforces network access policies. While Cloud RADIUS can not prohibit specific sites or apps, it may group users into VLANs and apply other network controls, such as site or app restrictions. For example, you can restrict access to GenAI tools, such as ChatGPT or Claude, to corporate-managed devices with EDR enabled. At the same time, you can block access from unverified personal devices, even if they are using corporate Wi-Fi.

This eliminates the guesswork of device trust and prevents credential-based attacks. Certificates cannot be phished, shared, or reused. When combined with dynamic policy enforcement, certificate-based access is a powerful tool for ensuring that only compliant, trustworthy devices may interact with GenAI platforms on your terms.

Define Policy-Based GenAI Access Rules

A better approach than outright bans is to set device- and identity-based policies that govern access to GenAI platforms like ChatGPT and Claude. SecureW2’s Cloud RADIUS and policy engine allow you to define access rules based on device health and user identity. Once connected, any content or application restrictions will be handled by other network security tools.

Use Zero Trust Network Access (ZTNA) principles: never trust the network; instead, verify the user and device each time. SecureW2’s cloud-hosted RADIUS and EAP-TLS use X.509 certificates to authenticate devices and users without requiring passwords. During authentication, Cloud RADIUS assesses IdP user attributes (group, role, department) and device posture data from Intune/Jamf/Defender/CrowdStrike (MDM compliance, encryption, and EDR health).

Define granular, conditional access such as:

• Allow ChatGPT only for Intune-compliant Windows machines running Defender and Engineering group users.
• Deny Claude on mobile unless MDM-managed and encrypted, with an active CrowdStrike sensor.

Enforcement occurs at the network layer, not the browser: assign SSID allowlists, dynamic VLANs, and downloadable ACLs (dACLs) via RADIUS. If posture changes in the middle of a session, use RADIUS Change of Authorization (CoA) to quarantine or restrict access right away.

However, nothing prevents someone from connecting to their personal cellular network and using tools such as ChatGPT. That is outside the scope of network enforcement. However, the same certificates used for network access may also be necessary for accessing corporate email and sensitive business applications. This ensures that even if someone uses their personal device on cellular, they cannot access secured company assets while using AI tools.

This architecture allows for real-time adaptation and ongoing validation: certificates may be short-lived or revoked for noncompliance, and policies respond instantaneously to IdP group or risk-score changes, allowing you to keep control when new GenAI tools emerge without resorting to blanket bans.

Device Trust Vs. Blocking AI Tools

Monitor, Revoke, and Adapt in Real Time

Security does not end after access is granted. It is equally crucial to monitor usage and adapt as the circumstances change. SecureW2 ensures that only users with healthy, compliant devices have access to essential systems or apps, prohibiting unauthorized access if security standards are not satisfied.

If a device falls out of compliance, such as when Microsoft Defender is switched off or the device is no longer managed, SecureW2 can immediately revoke its certificate. You can also initiate revocation when an employee leaves the organization (via IdP sync) or when a device’s risk score exceeds your threshold.

This dynamic reaction enables you to prevent illegal access without restricting each new GenAI tool that surfaces. Instead of looking for tools, you establish a flexible trust structure that adapts as your environment changes.

New GenAI platforms will continue to emerge. Your policies and enforcement tools must keep up. SecureW2 assists your team in maintaining control while accelerating innovation by focusing on device trust, certificate management, and real-time posture checks.

Don’t Block GenAI, Secure The Network Around It

Blocking GenAI is not a long-term solution. Modern enterprises require control: the power to determine who may access GenAI tools, which devices, and under what security settings. Organizations may promote innovation while reducing risk using device trust, certificate-based authentication, and policy-based enforcement. SecureW2 enables this by transforming your GenAI governance policies into enforceable, real-time controls.

Contact us now to implement device-trust-based access the right way.