Felix Group Holdings

Tony Chan, Chief Information Officer at Felix Group Holdings, oversees IT governance across a mixed Windows and Mac environment, managed through Kandji and Iru, and a workforce split between engineering and business functions with very different AI tool needs.

That split put pressure on how Felix could govern AI use without a one-size-fits-all policy. Chan's team addressed it by deploying UpGuard User Risk, replacing rigid network-level web blocks with granular, identity-level governance. UpGuard User Risk lets organizations, like Felix, surface the shadow AI and human risks hiding inside their workforce.

An overnight filter update cost Felix half a day

Before implementing UpGuard User Risk, Felix relied on traditional network-level web filtering managed through its Managed Service Provider (MSP). 

Blocking an AI category meant enforcing the same, company-wide policy—engineering teams needed access to specialized AI research tools like Hugging Face. In contrast, other business units needed strict boundaries around the same categories.

The same rigid approach also broke things it wasn't meant to touch. When monday.com added native AI features, the MSP's automated category filter blocked the entire platform company-wide overnight, and the resulting support ticket wait cost Felix half a day of productivity, leaving employees waiting for access to be restored.

Identity-level control replaced network-wide blocks

Deploying UpGuard User Risk gave Felix precise control down to individual job titles and individual users, rather than one policy applied network-wide. Running the browser extension in discovery mode quickly surfaced four to five unsanctioned shadow AI applications, including ChatGPT, Gemini, Perplexity, and unapproved instances of Claude.

The visibility paid off immediately. On day one of enforcement, User Risk flagged two Customer Success employees attempting to log into their consumer-tiered licensed ChatGPT and Gemini accounts. 

For the AI tools Felix does sanction, User Risk added a toggle that blocks employees from signing into personal Google accounts on corporate-approved Gemini instances. This eliminates consumer data-training exposure that a network-level filter couldn't see, let alone stop.

"The real major change is that granularity of control. Previously we had no granularity, but now we can pinpoint to a specific person. We can be very precise in what we block, what we don't block, and who we block... that level of control is really good."  — Tony Chan, Chief Information Officer, Felix Group Holdings

Audit-readiness Felix can prove on demand

When external consultants ran a formal AI governance readiness audit alongside an ISO 27001 evaluation, they asked how Felix ensures employees aren't using shadow AI. Rather than pulling a static policy document or waiting a week for MSP log exports, Tony Chan opened the UpGuard dashboard live to show real-time telemetry of blocked policy violations.

"If you're not able to show that evidence in a quick turnaround, it gives the auditor the impression you're not sure you actually have things under control. It's not just governance — it's demonstrating our capability." — Tony Chan, Chief Information Officer, Felix Group Holdings

The governance rollout Felix hasn't had to repeat

Felix moved through a deliberate maturity arc to reach audit-ready governance. The team began in discovery mode, running User Risk passively to establish a baseline of AI and SaaS traffic across the company before touching any policy. Only once that visibility existed did Felix classify the newly discovered applications and set block policies for unapproved AI tools. Enforcement, and the audit proof that came with it, came last. This took two weeks of groundwork.

That same discovery layer now feeds directly into how Felix vets vendors. Felix already uses UpGuard Vendor Risk for supplier assessments, which lets them assess and monitor vendors' security posture from one place. Applications that User Risk surfaces as shadow IT populate automatically into Vendor Risk as detected products, so a tool that starts as an unapproved browser extension can move straight into a formal security review. All without IT having to rediscover it or start a vendor evaluation from scratch each time.

The result is a governance posture Felix can keep building on rather than one it has to re-run from zero. New shadow tools get classified into the same policy structure, and any that warrant it automatically move into vendor vetting.

Key Outcomes 

• Cuts vendor risk assessment time from days to a quick validation pass, freeing security engineers from drafting reports by hand
• Turns real-time policy telemetry into audit evidence a non-technical reviewer can follow on the spot, with over a week saved on prep
• Gives a lean IT function the same precision as a much larger team — pinpointing a single user or job title without adding headcount

Where Felix’s story goes next 

Felix's AI governance work continues alongside its ISO 42001 certification process, with the same evidence User Risk already produces feeding into that effort.