Comparison
ShadowLock vs Control D for shadow AI
Control D is a transparently priced DNS filter. ShadowLock is a transparently priced shadow AI control across three layers - endpoint, browser, and Microsoft 365 tenant. Both publish their pricing - but only one of them can read pastes and scan your tenant for AI OAuth grants.
The quick verdict
Control D blocks the resolver request. ShadowLock blocks the paste. If your shadow AI policy is binary (allow / deny by domain) and your devices reliably resolve through Control D, the DNS layer is enough. The moment policy needs to be content-aware, you need the endpoint.
A DNS blocklist is only as current as its list, and employees reach 3–5 new unsanctioned AI tools every month. ShadowLock detects 100+ AI tools and apps at the endpoint and browser, and classifies what's pasted into them, rather than racing to blocklist new domains at the resolver.
More in the State of Shadow AI 2026 report →Side by side
| Dimension | ShadowLock | Control D |
|---|---|---|
| Where it sees AI | Endpoint clipboard + browser + M365 tenant via Microsoft Graph. | DNS resolver only. |
| M365 tenant / Copilot OAuth | Graph integration scans for AI OAuth grants and Copilot plugins; alerts on new consent. | Not visible at the DNS layer - OAuth consent never produces a resolver query from the endpoint. |
| Embedded AI inside approved SaaS | Caught at the paste layer. | Not caught - same blind spot as any DNS filter. |
| Data classification | Local Shannon entropy + Luhn + tiered confidence on every paste. | None - DNS is categorical, not content-aware. |
| Pricing | Public $0.80–$1.00/device/month, no minimum. | Transparent - $2/endpoint/month; MSP $150/month minimum. |
Two transparent prices, two different layers
What ShadowLock and Control D share is procurement transparency - both publish their pricing in an MSP market where most browser-security and DLP competitors don\'t. What they don\'t share is layer.
Control D resolves a name, decides allow or block, and the rest of the stack never sees the request. ShadowLock runs after the connection - inside the device - and decides allow or block based on what the user actually pastes. The two are complementary far more than they\'re competitive: most shops that take shadow AI seriously run a DNS layer for the easy categorical wins and an endpoint layer for the nuanced ones.
Which one fits your situation?
Choose ShadowLock when…
- ✓You need content-level enforcement - "allow ChatGPT but block sensitive pastes."
- ✓You use Copilot, Notion AI, or any embedded AI inside approved SaaS that DNS can't separate.
- ✓You need clipboard-level classification for HIPAA, SOC 2, or GDPR.
- ✓You can't guarantee every device routes through the Control D client every time.
Control D still fits if…
- •You want a transparently priced DNS filter as a baseline network-edge layer.
- •Your AI threat model is "block every AI domain at the resolver" and that genuinely satisfies your governance team.
Frequently asked questions
Do ShadowLock and Control D conflict on the same endpoint?+
No. Different layers - Control D is a DNS resolver / roaming client; ShadowLock is a Windows service. They run alongside cleanly.
Can Control D block AI features embedded in approved SaaS?+
No - same blind spot as any DNS filter. Copilot, Notion AI, and Einstein all resolve to allowed domains. ShadowLock catches them at the paste layer.
How does the pricing compare?+
Control D is $2/endpoint/month with a $150/month MSP minimum. ShadowLock is $1.00 → $0.80/device/month with no minimum. Different layers, similar transparency.
Compare ShadowLock to other shadow AI tools
Researching alternatives? Honest side-by-side comparisons against every MSP-channel shadow AI tool.
AI-native XDR with no M365 scanning. We scan the tenant and publish a price.
Browser-only. We add endpoint and M365 tenant.
Blocks AI apps. We inspect the prompt content.
Resolver-layer only. Blind to embedded AI and M365 OAuth.
Browser isolation. We are purpose-built for shadow AI.
Governs shadow AI inside the E5 stack. We need no E5 license.