Home
 >  
Case Studies
 >  

How CloudEagle.ai Assigned GenAI Risk Scores to Every SaaS Tool For Benchling

 “We had 287 approved SaaS vendors. CloudEagle showed us that 63 had quietly become GenAI platforms, and 11 were training on our data by default. We switched AI training off in 8 of them in a single afternoon. The other 3 went straight into access lockdown while we worked out the rest.”

~ Vineet Gopal, Head of Technology, Benchling

‍

63 of 287
approved SaaS tools use GenAI
11
train on customer data
8
training disabled in one day

63 of 287

approved SaaS tools use GenAI

11

train on customer data

8

training disabled in one day
Problems
Challenge
  • Previously approved SaaS vendors across CRM, collaboration, design, and support quietly added GenAI features and updated terms without visibility.
  • The board asked which vendors used customer data for AI training, answering it meant manually reviewing privacy policies across 287 apps.
  • Where it couldn’t be disabled, sensitive data continued flowing through user access with no link between risk and provisioning.

‍

Solutions
Solution
  • CloudEagle surfaced GenAI Usage and AI Training Exposure signals for every SaaS vendor in the portfolio, inside each vendor's profile alongside spend and usage data.
  • A single filterable view across all seven GenAI risk signals replaced manual privacy-policy research with one filter applied to the full 287-app portfolio.
  • AI Disable Controls signal per vendor showed where training could be turned off at the enterprise account level. 

‍

Profit
Result
  • 63 of 287 approved SaaS vendors identified as GenAI-enabled, with risk scores, including tools the security team had originally approved as traditional SaaS.
  • 11 vendors confirmed to train AI on customer data by default, with the full list produced in one filter instead of 11 manual reviews.
  • AI training switched off in 8 of the 11 vendors in a single afternoon, with the action and owner recorded against each vendor record.

‍

Challenge

The risk: Benchling had already vetted its SaaS portfolio, but that approval was based on how those applications operated when they were adopted, not on how they operated after adding GenAI.

A previously trusted vendor could introduce AI search, copilots, summaries, or model-training practices without triggering a new security review.

That created a blind spot with potentially serious consequences. Customer data could be exposed to new AI capabilities or used for model training under updated vendor terms, while security teams had no centralized way to know which applications had changed or whether those capabilities could be disabled. The risk wasn't limited to shadow AI, it was trusted applications quietly changing their data practices after approval.

For the CISO, this meant the company could have hundreds of applications that were technically “approved,” while some no longer met the assumptions under which they were originally vetted. And when the board asked which vendors were using GenAI or training on customer data, answering required manual investigation across hundreds of applications.

The bigger risk: Benchling could have a well-governed SaaS portfolio on paper while AI-related changes were quietly creating new data exposure and compliance gaps underneath it.

‍

Solution
  • GenAI Risk Scores applied to every SaaS vendor in the portfolio, covering AI training exposure, AI disable controls, GenAI usage, MFA support, SSO support, certifications, and data center standards.
  • Shadow AI & Shadow IT discovery surfaced GenAI features inside already-approved SaaS, including AI assistants added to collaboration, CRM, and design tools after the original contract.
  • Filterable portfolio view across all seven risk signals, so security could isolate every tool that trains AI on customer data, every tool without MFA, and every tool without SOC 2 certification in one query.
  • AI Disable Controls signal per vendor, showing whether GenAI features could be switched off at the enterprise account level, with links into the relevant admin configuration.
  • Self-Service App Catalog tied each access request to the vendor's GenAI risk score, so new provisioning to high-risk AI-training vendors required a risk acceptance before approval.

‍

Why CloudEagle.ai?
  • GenAI risk visibility across the full SaaS portfolio in one view, not one vendor at a time through manual privacy-policy research.
  • Seven risk signals per vendor, including the three most consequential for GenAI governance: AI training exposure, AI disable controls, and GenAI usage.
  • Risk signals live inside each vendor's profile alongside spend, usage, and contract data already in CloudEagle, so governance runs in the same place as the rest of SaaS management.
  • Risk score wired into access provisioning through the Self-Service App Catalog, so the score gated who could use high-risk vendors rather than sitting in a dashboard.
  • Portfolio-level filtering answers board questions directly: every tool that trains AI on customer data, every tool without MFA, every tool without SOC 2, in one query.

‍

Impact

Portfolio-Wide GenAI Visibility

  • 63 of 287 approved SaaS vendors identified as GenAI-enabled, including tools originally approved as traditional SaaS.
  • Board questions about GenAI vendor exposure answered through a single filter on the portfolio rather than manual privacy-policy research.
  • Risk signals for every vendor maintained continuously alongside spend and usage data, so the view stayed current as vendors added or changed GenAI features.

‍

AI Training Exposure Mitigated

  • 11 vendors confirmed to train AI on customer data by default, surfaced as a filtered list rather than discovered one at a time.
  • AI training switched off in 8 of the 11 vendors in a single afternoon, with the action and owner recorded against each vendor.
  • Access to the remaining 3 training-enabled vendors scope-reduced through user access reviews, narrowing the pool of users able to push sensitive data into those tools.

‍

Sustained GenAI Governance Posture

  • New access requests to GenAI-enabled vendors now route through the Self-Service App Catalog gated by the vendor risk score.
  • Risk signal changes (a vendor adding AI training, losing a certification, dropping MFA) surface as alerts rather than being discovered at the next board meeting.
  • Board-level GenAI risk reporting moved from manual document pulls to a live dashboard with vendor scores and disable-control status attached.

‍

The Transformation

Before CloudEagle
GenAI adoption assumed to be a shadow IT problem, with approved SaaS vendors treated as already-reviewed.
Vendor AI training status researched manually by reading privacy policies one tool at a time.
AI disable controls sat in each vendor's admin settings with no central record of which vendors offered them.
App access requests routed through intake with no reference to the vendor's GenAI risk posture.
Board questions about vendor-level AI risk answered through ad-hoc spreadsheets compiled under deadline.
After CloudEagle
Check box
Every approved SaaS vendor carries a GenAI risk score covering training exposure, disable controls, and five other security signals.
Check box
Vendor AI training status filterable across the full 287-app portfolio in one query, with results current alongside spend and usage data.
Check box
AI Disable Controls signal per vendor surfaces which tools offer enterprise-level disable, with links into the relevant admin configuration.
Check box
Access requests to GenAI-enabled vendors gated by the vendor risk score through the Self-Service App Catalog.
Check box
Board questions about vendor-level AI risk answered from a live dashboard with vendor scores and disable-control status attached.

Achieve similar success with CloudEagle!

Book a demoContact us

Other case studies

How Simplicity Turned App Usage Blind Spots Into License Savings
How Simplicity Turned SaaS Spend Into Board-Ready Reports with Department-Level Visibility
CloudEagle Enabled Secure and Auditable AI Adoption Across Teams