← AI inventory

Local model files

Endpoint Unknown vendor · Local runtime · model_file: C:\\Users\\grace\\.ollama\\models\\blobs · model_file: C:\\Users\\frank\\.ollama\\models\\blobs · model_file: C:\\Users\\grace\\.cache\\lm-studio\\models

Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Finding · Open
Risk score
48
Medium
People
2
Accounts seen on devices
Devices
2
2 accounts · 30 days
Last seen
26 h ago
First seen Aug 16, 2026
endpointlocal-inference
Next steps

Recommended actions

  1. 01Local inference keeps prompts on the device but sits outside every SaaS control: no DLP, no audit trail, and models of unknown provenance. Confirm these devices are managed and decide whether local AI is allowed at all.
Endpoint

What Defender for Endpoint saw

Model files · 3
Devices
  • LT-FRANK
  • WS-RESEARCH-01
Model files
12 files · 43.4 GB
Who

People

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

PersonDepartmentSourceSign-ins · 30 dGranted
[email protected]
[email protected]
n/aDevice telemetry0No direct grant
[email protected]
[email protected]
n/aDevice telemetry0No direct grant
Why

Evidence

  1. endpoint_telemetry · Sep 13, 2026
    Defender for Endpoint saw local model files on 2 devices (2 accounts) in 30 days: 12 model files (44441 MB) written
    Detail
    {
  "domains": [],
  "signals": {
    "network": 0,
    "process": 0,
    "software": 0,
    "extension": 0,
    "model_file": 3,
    "local_server": 0
  },
  "software": [],
  "processes": [],
  "extensions": [],
  "deviceNames": [
    "LT-FRANK",
    "WS-RESEARCH-01"
  ]
}