Customer story · AI governance · Last updated November 2026
Western Wealth Advisors, a decentralized RIA based in Golden, Colorado, uses Advisor Armor's software application monitoring to find AI applications installed on advisor devices, flag the ones its policy doesn't allow, and follow up with each advisor. Before that, its technology team had no reliable way to audit which AI apps were on those devices.
At a glance
Customer: Western Wealth Advisors, Golden, CO
Environment: Decentralized RIA with affiliated advisors on their own devices
Challenge: No effective way to audit AI apps installed on advisor devices
Solution: Advisor Armor software application monitoring, prohibited and required app lists, alerts and reports
Result: Email alerts after each device scan, advisor follow-up on every flagged app, and reports showing affiliates use approved AI tools
The challenge: an AI policy nobody could check
Writing an AI policy is the easy part. Checking it is harder, and at a decentralized RIA it's harder still. Western Wealth's advisors work across affiliated offices, on devices the home office doesn't touch every day, and any of them can download an AI app in under a minute.
That's shadow AI: AI tools people use for work without the firm's approval. Nobody has to be acting in bad faith. An advisor installs an AI notetaker to save time on meeting summaries, and now client conversations are going to a vendor nobody reviewed.
Alex Ortiz, Technology Manager at Western Wealth, described where the firm started:
"We did not have an effective way to audit installed AI apps on their device." Alex Ortiz, Technology Manager, Western Wealth Advisors
The firm wanted two things. First, visibility: a list of the AI applications actually installed on advisor devices. Second, a way to act on that list, by investigating each app and deciding whether its use case fit the policy.
Why AI visibility matters for an RIA
Regulators have been moving in the same direction for three exam cycles. The SEC's Division of Examinations said in its fiscal 2025 priorities that it would look at whether firms monitor and supervise AI use. For fiscal 2026 it said it would review controls to mitigate new risks associated with AI. On October 23, 2026, the fiscal 2027 priorities kept AI on the list under a new name, "super intelligence" (SI).
Whatever examiners call it, the first question is the same: what AI tools are in use at your firm? A firm can't answer that from a policy document.
Ortiz explained why the visibility matters to Western Wealth's program:
"Visibility into employee AI application usage allows Western Wealth to identify unauthorized or high-risk AI tools, reduce the likelihood that confidential client or firm information is exposed, and maintain appropriate oversight of how AI is being used. This visibility supports the firm's cybersecurity, privacy, recordkeeping, and regulatory compliance obligations while enabling responsible use of approved AI technologies."
Note the last clause. Western Wealth wants advisors using approved AI tools, with a record showing the firm checked.
The solution: software application monitoring on every enrolled device
Western Wealth uses the software application monitoring built into Advisor Armor's cybersecurity compliance platform. The Advisor Armor Applet scans each enrolled device, compares the installed applications against the firm's software policies, and sends alerts and reports to administrators.
In practice it runs as three steps:
Detect. Device scans identify installed AI applications on each enrolled advisor device.
Set policies. Administrators keep a prohibited applications list and a required applications list in the administrator portal.
Investigate. When a scan flags an AI app, the technology team gets an email alert, reaches out to the advisor and reviews how the app is being used.
Setting the policies took little effort. In Ortiz's words:
"The portal's intuitive interface makes it easy to set up prohibited and required apps. It is easy to manage the lists and make changes to both prohibited and approved applications."
That matters because the AI market changes monthly. A prohibited list that's painful to update goes stale, and a stale list is worse than none: it suggests oversight the firm doesn't have.
Those lists work best alongside the firm's written policies and procedures, which Advisor Armor builds to include hardware and software rostering. The approved-app list and the written AI policy should name the same tools.
The results: visibility the team can act on
After running the feature for a while, Ortiz told Advisor Armor founder Mark Brown on October 29, 2026: "It is working great. We are reaching out to many advisors when flagged."
Here's what changed:
Automated alerts. Email notifications after each device scan tell the technology team which AI applications to review. No one has to go hunting.
Follow-up on every alert. Each alert leads to a conversation with the advisor about the use case, so the firm makes a decision on that app instead of assuming.
Simple policy upkeep. Administrators add and remove apps from the prohibited and required lists as tools appear or get approved.
Oversight across affiliates. The administrator portal and reports show monitoring results across participating devices in one place.
The speed of the rollout stood out to Western Wealth:
"The Advisor Armor team was able to provide us with a quick solution to manage what AI applications are in use in our de-centralized RIA environment. With the helpful administrator portal and reports we can ensure our affiliates are only using AI applications that are approved." Alex Ortiz, Technology Manager, Western Wealth Advisors
What application monitoring does not cover
Installed-software monitoring sees applications on enrolled devices. It doesn't see AI used in a web browser, the prompts someone types, or the information they paste into an AI service. It answers one question, "what's installed?", and the rest of an AI governance program has to answer the others.
If you're building AI oversight, pair it with the controls that cover the gaps:
Web or DNS filtering for browser-based AI sites
Data loss prevention for client data leaving the firm
Admin and audit logs on the enterprise AI tools you approve
Training, so advisors know which tools are approved and why
Vendor due diligence on approved AI tools, which are service providers under Regulation S-P like any other (see our white paper on service provider oversight)
How to detect shadow AI at your RIA: the Western Wealth approach
You can copy Western Wealth's process in five steps.
Enroll every device that touches client data. That includes affiliate and remote advisors' devices. Monitoring can't report on a device that isn't enrolled.
Build your approved and prohibited lists. Start with the AI apps your policy already names, then add what the first scans turn up.
Turn on alerts and name an owner. Someone on the technology or compliance team should get every alert and be accountable for closing it.
Review the use case and record the decision. Talk to the advisor. Approve the app, swap it for an approved tool, or remove it, and write down which.
Pull reports on a schedule. Monthly reports become your AI inventory and your evidence of oversight for the annual compliance review and the next SEC exam.
What's next for Western Wealth
Western Wealth is considering a second application policy for another group of its affiliates. It would use a separate device roster and produce its own report.
Frequently asked questions
What is shadow AI?
Shadow AI is any AI tool employees use for work without their firm's approval, such as a consumer chatbot, an AI notetaker or an AI writing app. At an RIA, the risk is that client or firm information reaches a vendor the firm never reviewed.
How can an RIA see which AI apps advisors have installed?
Use software application monitoring on every device that handles client data. Advisor Armor's applet scans enrolled devices, compares installed apps against the firm's prohibited and required lists, and sends email alerts and reports to administrators.
Does application monitoring detect AI tools used in a browser?
No. Installed-software monitoring doesn't show browser-based AI activity, prompts, or information shared with AI services. Cover those with web filtering, data loss prevention and the audit logs of approved AI platforms.
What do SEC examiners expect from RIAs on AI?
The SEC's fiscal 2026 examination priorities include reviewing controls that mitigate risks from AI. The fiscal 2027 priorities, released October 23, 2026, keep AI in focus under the term "super intelligence." Expect examiners to ask which AI tools your firm uses and how you supervise them.
How long does Advisor Armor take to set up?
Onboarding takes about 20 to 30 minutes, and ongoing upkeep takes about 15 minutes a month. Western Wealth set up its prohibited and required application lists in the administrator portal.
See which AI apps are on your firm's devices
Advisor Armor helps 1,000+ financial services firms document cybersecurity compliance. Talk to our team to see software application monitoring running on your own advisors' devices.
