Shadow AI Discovery: How to Find Every AI Tool Your Employees Are Already Using

1 day ago
8 min read

By Yonatan Hoorizadeh CISSP, CISM, CRISC, AAISM

Published By: Purple Shield Security

Published: September 2, 2026

Last updated: September 2, 2026

Shadow AI discovery means finding the AI tools employees adopted without approval. Four sources surface almost all of them: OAuth grants in your identity provider, corporate card and expense records, browser extension inventories, and outbound DNS or proxy logs. Start with identity, because it shows both the tool and the data it can reach.

What is shadow AI, and why has it become a breach problem?

Shadow AI is the use of AI tools, applications, or browser extensions without approval from IT or security. It stopped being a theoretical governance concern this year. IBM and the Ponemon Institute reported that the share of security incidents involving shadow AI more than doubled year over year to 43%, based on a study of 602 organizations across 17 industries and 16 countries that were breached between March 2025 and February 2026.

The cost moved with it. The same report put the global average cost of a data breach at $4.99 million, a 12% increase and a record, according to coverage of the findings by Alston & Bird. IBM also found that 68% of breached organizations had no policy in place to oversee AI use or manage shadow AI.

The comparison people reach for is shadow IT, when employees routed around slow procurement to use Dropbox and personal cloud accounts. The mechanics rhyme. The payload does not. A shadow IT tool stored a copy of a file somewhere you did not choose. A shadow AI tool ingests the contract, the source code, or the patient record and sends it to a third-party model provider, often under a permission grant that keeps reading your systems long after the employee stops using the tool.

Adoption is also running well ahead of oversight. The 2026 Enterprise AI Trends Study from Smarsh, conducted by FTI Consulting, found 55% of enterprises actively deploying AI while only 26% said their governance frameworks were keeping pace, and only 30% reported the ability to detect AI tools running outside approved workflows.

Why your AI policy did not stop this

A written AI policy does not produce an inventory. It describes what employees are permitted to do. Discovery tells you what they actually did. Most companies wrote the policy, published it in the handbook, and treated the topic as closed, which is why IBM found more than two-thirds of breached organizations still had no governance process to limit shadow AI, a slight increase over the prior year.

Three things keep the gap open. The approved path is slower than the unapproved one, or does not exist at all. Employees encountered these tools personally before they encountered them at work, so the tools feel ordinary rather than risky. And procurement never sees any of it, because a $20 monthly subscription or a free tier never crosses a purchasing threshold that would trigger review.

The practical consequence is that leadership estimates of AI tool usage are consistently low, and not by a small margin. That is not a discipline problem inside the workforce. It is a visibility problem, and visibility is something you can go get.

How do you find the AI tools already in use?

Four data sources you already own will surface most shadow AI in about a week. Run them in this order: OAuth grants in your identity provider, corporate card and expense records, browser extension inventories, and outbound DNS or proxy logs. Identity goes first because it is the only source that tells you both which tool is in use and what data that tool can reach.

Start with OAuth grants in your identity provider

In Google Workspace, this lives in the Admin console under Security, then API controls, then third-party app access. In Microsoft Entra ID, look under Enterprise applications and filter to user-consented applications. Export the full list and record the granted scopes alongside each app.

The scope matters more than the app name. A meeting note-taker with calendar read access is a minor concern. The same vendor with read access to a partner's mailbox or your shared Drive is a data exposure with a permanent connection to your tenant. This source captures every tool an employee signed into with company credentials, which in most organizations is the majority of them.

Pull twelve months of card and expense data

Filter corporate card transactions and expense reimbursements for recurring charges under a few hundred dollars, concentrated in software, subscription, research, and professional development categories. Individual AI subscriptions typically land between $20 and $60 per month and get expensed without a second look.

This source finds the paid tools that never appeared in your identity provider because the employee signed up with a personal email address and expensed the receipt.

Inventory browser extensions

AI writing assistants, meeting recorders, and page summarizers frequently install as browser extensions, and reading page content is their intended function rather than a side effect. Chrome Enterprise, Edge management, or your endpoint agent can list installed extensions per device.

Cross-reference each extension against the permissions it requested. An extension holding permission to read and change all data on all websites is reading whatever is on screen in your CRM, your practice management system, and your electronic health record, whether or not anyone intended that.

Query outbound traffic to AI domains

Pull 90 days of DNS or web proxy logs, filter to known AI service domains, and count unique internal sources per domain. This is the only one of the four sources that catches free-tier usage through personal accounts on company devices, which is the category the other three cannot see.

It is also the heaviest lift and depends on your log retention, which is why it goes last rather than first. If your retention window is shorter than 90 days, run the other three now and fix retention in parallel.

What do you do with the inventory once you have it?

Sort the list by data reach, not by how many people are using each tool. One application holding read access to an executive's mailbox is a larger exposure than forty people pasting text into a free summarizer with no account linkage. IBM found that 92% of organizations that suffered an AI-related breach lacked adequate AI access controls, and only about four in ten said they limited access to their AI systems at all.

IBM's researchers were direct about the cause, writing that identity controls “have failed to keep pace” with the spread of AI across corporate networks. That framing is useful, because it points the fix at something most security teams already know how to do rather than at a novel AI control set nobody has built yet.

Sort every tool into one of three buckets. Revoke now, for anything whose granted scope exceeds its business purpose or that sits in a regulated data path with no contract behind it. Sanction, for tools with a genuine use case and an acceptable vendor, which then get brought under an enterprise agreement and single sign-on. Replace, for tools meeting a real need through an unacceptable vendor, which requires standing up an approved alternative before you switch anything off. A fractional CISO running this exercise will usually get through the sort in a single session once the raw inventory exists.

Your regulatory exposure changes the urgency of the first bucket. If you are a HIPAA covered entity or business associate, any tool that received protected health information without a business associate agreement in place is a potential impermissible disclosure, and it needs to be assessed under the HIPAA Breach Notification Rule with counsel rather than logged as a policy violation and forgotten. If you carry SOC 2 or ISO 27001, unapproved tools sit outside your vendor management control, and auditors are now asking for the AI inventory by name. Companies under roughly 50 people with no regulated data can stop after the identity sweep and one sanctioned tool, and should resist building a program they cannot staff. Mapping those obligations to your actual data flows is ordinary risk assessment services work, not an AI specialty.

What to do this week

Six concrete actions, in the order they pay off.

Export user-consented third-party application grants from Microsoft Entra ID or Google Workspace and sort the results by granted scope.
Revoke any grant carrying mailbox or file-store read access for which no one can name a business owner.
Pull twelve months of corporate card transactions, filter to recurring charges under $200, and flag every AI vendor that appears.
Name one person who owns the AI tool approval decision, and give that person a response time measured in days rather than weeks.
Stand up one sanctioned AI tool with an enterprise agreement before announcing any restriction. Prohibition without an alternative moves the activity to personal phones, where you have no logs at all.
Put the inventory in front of leadership as a count, not a narrative. A number on a slide changes budget conversations in a way that a risk description does not.

Frequently asked questions

How long does a shadow AI discovery take?

The identity provider sweep and the expense review together take a few days at most mid-market companies, and under a day at 30 people. Adding browser extension inventory and 90 days of egress log analysis extends it by one to two weeks, depending on your log retention and who has access to the proxy. Start with identity, because it delivers the highest-value findings first.

Does an employee pasting client data into ChatGPT count as a reportable breach?

It depends on the data and your obligations. For a HIPAA covered entity or business associate, disclosing protected health information to a vendor without a business associate agreement is an impermissible disclosure, and it must be assessed under the HIPAA Breach Notification Rule before you conclude anything. Bring counsel in before deciding the incident was harmless. For unregulated business data, the question shifts to contractual confidentiality obligations you may owe your own customers.

Should we just block AI tools instead?

Blocking on its own tends to relocate the activity rather than end it. Employees move to personal phones and home devices, where you have no logs, no scope visibility, and no ability to detect an incident at all. Pair any restriction with one sanctioned tool and a named approval path that answers requests in days.

We are a 30-person company. Is this overkill?

No, but scale it down. Run the identity provider sweep and the expense review, which together take under a day at that size, then sanction a single tool and name an approver. Skip the egress log analysis until you have someone who can maintain it. The goal at 30 people is a list you can read in one sitting, not a governance program.

Do we need an AI policy before we run the inventory?

Run the inventory first. A policy written without knowing what is already in use produces rules nobody can enforce and an approved-tool list that misses the tools people actually depend on. Discovery gives you the facts to write against, and it usually reshapes the policy substantially. Effective AI security governance is written from an inventory, not from a template.

The list of AI tools running inside your business already exists. Producing it takes about a week using data you already own, and it is the step that has to come before the policy, the training, and the approval workflow. If your team needs help running that discovery and turning it into an approval path people will actually use, Purple Shield's AI security services are built for exactly that kind of work.