Shadow AI Tools: How CISOs Can Find and Assess Them

Shadow AI is the use of generative AI services, features, or agents at work without the organization’s review or approval. A structured discovery and assessment process helps CISOs understand what employees use, what information may be exposed, and which risks need controls—without treating every use as misconduct. Start with an accountable cross-functional team and clear rules for handling sensitive data.

What You’ll Need

A sponsor and working group spanning security, IT, privacy, legal, procurement, HR, and relevant business teams.
Authorized access to identity, network, endpoint, cloud, browser, and SaaS administration data, subject to company policy and applicable privacy requirements.
An inventory or register for services, use cases, owners, data types, assessments, and decisions.
Existing policies for data classification, acceptable use, third-party risk, incident response, and records retention.
A communication plan explaining the review and how employees can disclose tools or ask for approved alternatives.

Step-by-Step

Define scope and purpose. Decide whether you are assessing public AI chat services, AI features embedded in approved software, coding assistants, transcription tools, browser extensions, or autonomous agents. Include both personal accounts used for work and business accounts. Set a time period and state what the review is meant to accomplish: safer use, risk reduction, and useful approved options. Do not collect more employee activity or content than necessary.
Set governance before collecting signals. Name a decision owner and clarify who can access discovery results. Agree with privacy, legal, and HR on permitted monitoring, notice, retention, and escalation. Use aggregated or pseudonymized data for initial analysis where practical. Limit identifiable review to a documented, authorized need, and keep access to findings restricted.
Ask employees and business owners directly. Use a short survey and interviews to ask which tools and features are used, for what tasks, by whom, and with what data. Ask whether an account is personal or organization-managed, whether outputs enter business systems, and whether a team has connected an AI service to files, email, code repositories, or other applications. Provide a simple way to disclose use without blame. A voluntary survey is useful but is not a complete inventory.
Correlate technical evidence. Review available DNS, secure web gateway, firewall, proxy, endpoint, browser-extension, identity, cloud access security broker, and SaaS discovery data. Search for known AI service domains and application records, then validate findings: a visit to a service does not prove sensitive use, and a new domain is not necessarily an AI tool. Check software inventories and procurement records too. For managed AI features, review tenant settings and service audit logs where available.
Find less visible integrations. Look for browser add-ons, desktop clients, API keys, AI functions inside approved SaaS products, workflow automations, and agents with delegated permissions. Examine OAuth grants and connected applications for access to mail, files, calendars, source code, or internal data. Confirm the application owner, requested scopes, and whether access is still needed. Do not assume a product is safe simply because it is already approved for another purpose.
Create a verified inventory. Record the service and provider, business owner, use case, user groups, account type, data categories, integrations, permissions, retention and training settings if documented, and evidence source. Mark each entry as confirmed, suspected, or unresolved. Note dates and confidence so an observed network event is not confused with verified use. Capture the business benefit as well as the risk; this helps prioritize useful, supportable alternatives.
Assess risk consistently. For each use case, ask what information is entered or retrieved, whether it is personal, confidential, regulated, customer, or source-code data, and whether outputs are checked before use. Assess provider terms and privacy documentation through established third-party review; verify data handling, retention, deletion, access controls, security documentation, and incident notification rather than relying on marketing claims. Evaluate authentication, encryption, logging, administrative controls, model or feature settings, and the risks of connectors or agent actions. Record uncertainties, not just a single score.
Prioritize by exposure and impact. Escalate promptly if evidence indicates credentials, sensitive personal information, confidential material, or restricted data may have been shared, or if an agent has broad access or can take consequential actions. Follow incident response and privacy procedures; preserve relevant evidence and involve the appropriate teams. For lower-risk uses, document conditions and remediation deadlines. A useful ranking considers data sensitivity, access scope, external sharing, user scale, and ability to contain misuse.
Choose a proportionate response. Options include approving the use with conditions, moving users to a managed tenant, limiting data or permissions, disabling an integration, blocking a service where justified, or prohibiting a specific use. If containment is needed, check business impact and provide a safe alternative. For exposed credentials, follow the credential-rotation process; do not simply remove a browser extension and assume connected tokens are revoked.
Publish guidance and repeat discovery. Explain approved tools, prohibited data, review steps for new services, and where to request exceptions. Train employees with realistic examples, especially on checking outputs and avoiding sensitive prompts. Recheck technical signals and the inventory on a defined schedule and after major product or policy changes. Track measures such as verified use cases reviewed, unresolved high-risk findings, exception age, and adoption of approved options.

Common Mistakes

Relying on one data source: Network logs miss offline clients and encrypted or unclassified traffic; surveys miss forgotten or undisclosed use. Combine evidence and state its limitations.
Treating every detection as a violation: A service visit could be incidental, and legitimate uses may be approved through another team. Verify context before acting.
Blocking first and asking later: Abrupt restrictions can disrupt work and encourage less visible workarounds. Pair necessary containment with communication and a usable alternative.
Ignoring embedded AI and integrations: A product may add AI features or new permissions after its original approval. Reassess material changes and connected applications.
Assuming policy or provider claims are controls: Confirm settings and contractual or technical evidence, and distinguish documented commitments from features actually enabled in your tenant.

Tips

Make disclosure easy and explain that the goal is to reduce risk and support productive work, not to punish good-faith reporting.
Separate discovery from investigation. Use a documented threshold before identifying individual employees or inspecting content.
Offer an approved route that meets common needs, such as drafting, summarizing, coding, or meeting notes, with clear data boundaries.
Keep decisions auditable: record the evidence, owner, risk rationale, conditions, reviewer, and next review date.
Test detections with authorized, benign activity and tune alerts to reduce false positives before relying on them for enforcement.

Troubleshooting

Logs show little activity: Check whether relevant endpoints and identity providers are in scope, whether logs are retained, and whether SaaS or browser telemetry is available. Ask teams and review procurement and OAuth records; do not conclude that no use exists from an empty dashboard.
You cannot identify a domain or application: Check the hostname and vendor documentation, compare with approved software records, and ask the business owner. Treat it as unresolved until validated; avoid blocking based on a name alone.
Employees will not disclose use: Revisit the purpose and privacy notice, involve trusted business leaders, and make the survey brief. Explain what is collected, who sees it, and how employees can request an approved option.
An integration has broad access: Identify its owner and exact permissions, preserve necessary evidence, then use established procedures to revoke or narrow access. Check and revoke related tokens or keys where appropriate, and verify that access has actually ended.
A possible data exposure is discovered: Stop further exposure using approved incident procedures, preserve relevant records, and involve security, privacy, legal, and the data owner as required. Avoid making unsupported claims about whether a provider retained or used the data.

Frequently Asked Questions

What counts as shadow AI?
AI services, features, extensions, or agents used for work without the organization’s required review or approval. Whether a tool is “shadow” depends on internal policy and the specific use.

Can network monitoring find every tool?
No. It can reveal useful signals, but may miss personal devices, offline use, embedded features, or traffic that cannot be reliably identified. Combine technical evidence with employee and business-owner input.

Should a CISO block every unapproved AI service?
Not automatically. Contain urgent exposure when needed, but weigh business impact, evidence, and available alternatives. A controlled approval path can reduce incentives to use tools secretly.

What should the assessment record?
Capture the tool, owner, purpose, users, data types, integrations and permissions, evidence, risk findings, decision, conditions, and review date. Restrict access to sensitive employee-level findings.

How often should the inventory be reviewed?
Set a recurring review cadence based on risk and change, and reassess after material product, permission, provider, or policy changes. Keep ongoing discovery active where lawful and appropriate.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →