Shadow AI: how to find the AI tools your employees already use
Every organization that looks finds more AI tools in use than it approved. The useful questions are how to look, what each method can and cannot see, and what to do with the answer.
- By
- GhostAudit
- Published
- Last reviewed
- Reading time
- 5 min read
Key points
- Shadow AI is unreviewed AI use, most of it well-intentioned. Treat discovery as fact-finding, not as an investigation of people.
- No single source sees everything. Identity, spend, code, network and endpoint data each catch what the others miss.
- Usage volume matters as much as presence: a tool used by 200 people needs a decision before a tool used by two.
- Discovery is only useful if every finding ends in a recorded decision.
What shadow AI is, and why it is different from shadow IT
Shadow AI is the use of AI tools for work without the organization having reviewed them. It is a descendant of shadow IT, with three differences that make it harder to manage.
The barrier to entry is nearly zero. Many AI tools are free, run in a browser tab and need no installation or procurement.
The risk is in what goes in. With most shadow IT the concern is an unmanaged system. With AI the concern is the content of each interaction: a contract pasted into a consumer chatbot, source code sent to an unvetted coding assistant, a customer list uploaded for analysis. Consumer tiers of AI tools may use what is entered for training unless the user opts out, and personal accounts sit outside your company's retention and access controls.
AI arrives inside tools you already have. A product approved two years ago may have gained an AI assistant last quarter.
None of this implies bad intent. People use these tools because they help. That shapes how discovery should be run: openly, with the aim of bringing useful tools under governance, not of catching anyone.
Why you need to know
Three reasons, in ascending order of urgency.
Policy. An acceptable use policy has to list approved tools. You cannot write that list without knowing what is in use.
Regulation. Obligations attach to uses, and you cannot assess uses you do not know about. A recruiter who shortlists candidates with a general-purpose assistant has, without anyone deciding it, put the company within reach of hiring-tool laws such as NYC Local Law 144 and, from 1 January 2027, Colorado's SB 26-189. Under the EU AI Act, employment is among the high-risk areas whose obligations begin on 2 December 2027.
Data exposure. If confidential information is already flowing into unreviewed tools, each week of not knowing adds to it.
Six ways to look
1. Ask
A short survey, or a round of conversations with team leads: which AI tools do you use, for what, and with what kind of data?
Sees: intent and context that no technical source can provide. Misses: anything people forget, do not think of as AI, or prefer not to mention. Surveys reliably under-report. Use them for context, not for counts.
2. Identity provider
Review the applications in your single sign-on tenant, such as Okta, and the OAuth grants users have given to third-party apps.
Sees: AI tools that were connected to corporate identity, with the number of people assigned. Misses: anything used with a personal email address, which is much of the consumer use.
3. Spend
Search expense reports, corporate card statements and procurement records for AI vendors.
Sees: paid tools, including team subscriptions that bypassed procurement. Misses: free tiers, and tools paid for personally.
4. Code repositories
Scan dependency manifests, such as requirements.txt or package.json, for AI SDKs and frameworks.
Sees: AI built into your own products and internal tools, often before anyone outside engineering has heard of it. Misses: everything outside code.
5. Network and DNS logs
Search proxy, firewall or DNS logs for the domains of known AI services.
Sees: any device on your network or VPN reaching an AI service, regardless of account. Misses: off-network use, which for a remote workforce is most use; and it requires care, because raw network logs contain far more than AI activity and are sensitive in their own right.
6. Endpoint sensors
A managed browser extension and a desktop agent that recognise AI tools and report their use.
Sees: web and desktop AI use on managed devices wherever they are, with real usage volume: how many people, how often, for how long. Misses: unmanaged and personal devices. The design of the sensor matters a great deal here; one that reports only the names of AI tools is a different thing, legally and culturally, from one that records browsing or content. See monitoring without surveillance.
What each method covers
| Method | Personal accounts | Free tools | Off-network | Usage volume | In-house AI |
|---|---|---|---|---|---|
| Asking | Partly | Partly | Yes | No | Partly |
| Identity provider | No | Only if SSO | Yes | No | No |
| Spend | No | No | Yes | No | No |
| Code scan | No | No | Yes | No | Yes |
| Network logs | Yes | Yes | No | Partly | Partly |
| Endpoint sensors | Yes | Yes | Yes | Yes | Partly |
The practical conclusion is to combine at least one identity or spend source, a code scan if you build software, and one source that sees actual use.
From a list to decisions
A list of forty tools is not an outcome. For each tool found, someone needs to decide one of four things.
- Sanction it. It is useful and acceptable. Record an owner, the data it may handle and any conditions, and add it to the approved list.
- Put it under review. It may be acceptable, but someone needs to look at its terms, its data handling and what it is being used for.
- Mark it unsanctioned. There is an approved alternative. Tell users what to use instead, and why.
- Prohibit it. The risk is not acceptable for any use.
Prioritise by exposure: the number of people using the tool, and the sensitivity of the work those people do. A tool used daily by a finance team deserves attention before one a single engineer tried once.
Record every decision, including the decision that something found is not a concern. An inventory in which every entry has an owner, a status and a date is what an auditor means by an AI inventory.
Telling people
Announce discovery before you run it. Say what you are looking at, what you are not looking at, and what will happen with the results: that the aim is an approved list people can rely on, and that nobody will be disciplined for past use of a tool no policy covered.
When you tell someone a tool is not approved, give them the alternative in the same message. Guidance that only says no produces workarounds.
Keeping it current
New AI tools appear every month, and existing products add AI features. A one-off audit is out of date within a quarter. Whatever sources you choose, set them up to report continuously, and route new findings to a person who decides.
How GhostAudit does this
GhostAudit combines these sources in one review queue: read-only connections to Google Workspace and Microsoft 365 that list the AI apps granted access to work accounts, Okta applications, GitHub dependency scans, a browser extension for Chrome and Edge, a desktop agent for macOS and Windows, and import of SSO or network log lines. Its catalog recognises 86 AI tools. Each finding arrives with its evidence; accepting it creates an inventory record, and dismissing it records why.
The sensors report tool names and time only, never prompts, page content or full URLs, and anything that is not on the AI tool list is discarded on the device. A tool's status, once decided, can be applied as a warning with your guidance or a block in the browser.
This guide is for orientation and is not legal advice. It was last reviewed on 10 November 2026; laws and guidance change, so check the official texts linked above. Spotted something out of date? Tell us.