[Customers](/customers) Felix Group Holdings # Felix Group Holdings A vendor procurement SaaS platform stopped blocking AI tools for everyone and started controlling access user by user. Day-to-day enforcement now doubles as audit evidence. [Read more](#start) 4 - 5 Unsanctioned shadow AI tools uncovered 1+ week Audit evidence prep time saved Days saved Vendor risk assessments, from several days to hours Felix Group Holdings runs a cloud-based vendor management platform used across industries with complex supply chains. Its workforce splits between engineering and business functions with very different AI tool needs, which put pressure on how Felix could govern AI use without a one-size-fits-all policy. ## ## Tony Chan, Chief Information Officer at Felix Group Holdings, oversees IT governance across a mixed Windows and Mac environment, managed through Kandji and Iru, and a workforce split between engineering and business functions with very different AI tool needs. That split put pressure on how Felix could govern AI use without a one-size-fits-all policy. Chan's team addressed it by deploying UpGuard User Risk, replacing rigid network-level web blocks with granular, identity-level governance. UpGuard[ ***User Risk***](https://www.upguard.com/product/user-risk) lets organizations, like Felix, surface the shadow AI and human risks hiding inside their workforce. ## An overnight filter update cost Felix half a day Before implementing UpGuard User Risk, Felix relied on traditional network-level web filtering managed through its Managed Service Provider (MSP).  Blocking an AI category meant enforcing the same, company-wide policy—engineering teams needed access to specialized AI research tools like Hugging Face. In contrast, other business units needed strict boundaries around the same categories. The same rigid approach also broke things it wasn't meant to touch. When monday.com added native AI features, the MSP's automated category filter blocked the entire platform company-wide overnight, and the resulting support ticket wait cost Felix half a day of productivity, leaving employees waiting for access to be restored. ## Identity-level control replaced network-wide blocks Deploying UpGuard User Risk gave Felix precise control down to individual job titles and individual users, rather than one policy applied network-wide. Running the browser extension in discovery mode quickly surfaced four to five unsanctioned shadow AI applications, including ChatGPT, Gemini, Perplexity, and unapproved instances of Claude. The visibility paid off immediately. On day one of enforcement, User Risk flagged two Customer Success employees attempting to log into their consumer-tiered licensed ChatGPT and Gemini accounts.  For the AI tools Felix does sanction, User Risk added a toggle that blocks employees from signing into personal Google accounts on corporate-approved Gemini instances. This eliminates consumer data-training exposure that a network-level filter couldn't see, let alone stop. > "The real major change is that granularity of control. Previously we had no granularity, but now we can pinpoint to a specific person. We can be very precise in what we block, what we don't block, and who we block... that level of control is really good."  — Tony Chan, Chief Information Officer, Felix Group Holdings ## Audit-readiness Felix can prove on demand When external consultants ran a formal AI governance readiness audit alongside an ISO 27001 evaluation, they asked how Felix ensures employees aren't using shadow AI. Rather than pulling a static policy document or waiting a week for MSP log exports, Tony Chan opened the UpGuard dashboard live to show real-time telemetry of blocked policy violations. > "If you're not able to show that evidence in a quick turnaround, it gives the auditor the impression you're not sure you actually have things under control. It's not just governance — it's demonstrating our capability." — Tony Chan, Chief Information Officer, Felix Group Holdings ## The governance rollout Felix hasn't had to repeat Felix moved through a deliberate maturity arc to reach audit-ready governance. The team began in discovery mode, running User Risk passively to establish a baseline of AI and SaaS traffic across the company before touching any policy. Only once that visibility existed did Felix classify the newly discovered applications and set block policies for unapproved AI tools. Enforcement, and the audit proof that came with it, came last. This took two weeks of groundwork. That same discovery layer now feeds directly into how Felix vets vendors. Felix already uses [***UpGuard Vendor Risk***](https://www.upguard.com/product/vendor-risk)*** ***for supplier assessments, which lets them assess and monitor vendors' security posture from one place. Applications that User Risk surfaces as shadow IT populate automatically into Vendor Risk as detected products, so a tool that starts as an unapproved browser extension can move straight into a formal security review. All without IT having to rediscover it or start a vendor evaluation from scratch each time. The result is a governance posture Felix can keep building on rather than one it has to re-run from zero. New shadow tools get classified into the same policy structure, and any that warrant it automatically move into vendor vetting. #### Key Outcomes** ** * Cuts vendor risk assessment time from days to a quick validation pass, freeing security engineers from drafting reports by hand * Turns real-time policy telemetry into audit evidence a non-technical reviewer can follow on the spot, with over a week saved on prep * Gives a lean IT function the same precision as a much larger team — pinpointing a single user or job title without adding headcount ## Where Felix’s story goes next  Felix's AI governance work continues alongside its ISO 42001 certification process, with the same evidence User Risk already produces feeding into that effort. "The consultants were surprised because they thought, 'You're not going to have anything to control.' But User Risk was doing more than the consulting firm had. Showing how everything is picked up and logged systematically turned the tables—it made it look like we were better prepared than they were." Tony Chan Chief Information Officer at Felix Group Holdings ## We’re experts in securing data breaches and data leaks We’ve helped Facebook, Dow Jones, Verizon, Ford, the RNC, GoDaddy and many other companies secure customer data. Don’t just take our word for it. As featured in [](https://www.washingtonpost.com/technology/2019/04/03/millions-sensitive-facebook-user-records-were-left-exposed-public-web-security-researchers-say/)[](https://techcrunch.com/2020/06/02/researchers-find-exposed-data-on-millions-of-users-of-quiz-app-tvsmiles/)[](https://www.nytimes.com/2018/07/20/business/suppliers-data-leak-automakers.html)[](https://www.forbes.com/sites/thomasbrewster/2019/01/16/massive-oklahoma-government-data-leak-exposes-7-years-of-fbi-investigations/#182b39126e11)[](https://www.bloomberg.com/news/articles/2019-06-27/ford-td-bank-files-found-online-in-cloud-data-exposure)[](https://gizmodo.com/amazon-engineer-leaked-private-encryption-keys-outside-1841160934) ## More customer stories We’ve helped hundreds of global companies. #### [Global Airline](/customers/global-airline) Taking third-party cyber risk visibility to 30,000 feet Read case study #### [Chemist Warehouse](/customers/chemist-warehouse) Scaling TPRM and cutting security assessment time by 75% Read case study #### [Riverside County](/customers/riverside-county) Cutting assessment time from days to minutes while strengthening TPRM Read case study #### [Anglo-Eastern](/customers/anglo-eastern) How Anglo-Eastern reduced false positives, prevented typosquatting attacks, and shifted to a proactive cybersecurity strategy. Read case study #### [Global Cloud Software Company](/customers/global-cloud-software-company) UpGuard helped this global cloud software company establish a comprehensive TPRM program that continues to manage 1000s of vendors. Read case study #### [St John WA](/customers/st-john-wa) UpGuard helps St John WA maintain visibility and coverage over thousands of vendors. Read case study [View all customer stories](/customers) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)