A sales manager pastes a table with the discount terms of the largest customers into a free AI chat, because she needs a quick summary before a meeting. A developer installs a browser extension that suggests code and is allowed to read every page he visits. A note-taking assistant, connected to the calendar with a single click, joins board meetings and transcribes the discussion. None of these people meant to harm the company — each of them wanted to work faster. The IT department knows about none of these tools.
This is what shadow AI looks like in practice. Banning AI usually does not solve the problem, it only moves it to personal phones and accounts, where the company loses what little visibility it had. Here we show how to approach shadow AI detection with data most organisations already collect — from DNS and proxy logs, the CASB, the identity directory and the endpoint inventory — and how to reduce it within a month so that teams do not lose the tools that genuinely help them work.
What is shadow AI and how does it differ from shadow IT?
Shadow AI is the use of artificial intelligence tools — chats, assistants, extensions and AI features in applications — without the knowledge and approval of the IT and security teams. You will find the full definition in the shadow AI entry of the nFlo glossary.
What sets it apart from classic shadow IT is what happens to the data. An unapproved task manager stores the information someone typed into it. An AI tool processes content by design: it summarises, rewrites and analyses it and answers on that basis, and the vendor — depending on the plan and the contract — may store prompts or use them to develop the service. Shadow AI is therefore first of all a data flow problem, and only then a software inventory problem.
The second difference is pace. AI features appear in applications the company approved long ago, often in a routine update. The OWASP GenAI Security Project says so plainly in the LLM Applications Cybersecurity and Governance Checklist (version 1.1, May 2024): it calls shadow AI the most pressing non-adversary LLM threat — unapproved online tools, unsafe browser plugins and third-party applications that add LLM features through updates, bypassing the software approval process.
The causes, consequences and prevention of unapproved IT tools in general are covered in the article what shadow IT is and how to prevent it. Here we deal with what is specific to AI: where to look for traces and how to reduce them.
What forms does shadow AI take in a company?
Shadow AI usually takes five forms, and each leaves different traces in company systems. The data source depends on which form you want to detect:
- Public AI chats on personal accounts — the employee signs in with a personal e-mail address, so the company controls neither history nor retention settings and has no access to the account logs.
- Browser extensions with AI features — translators, proofreaders, writing assistants and page summarisers that are granted permission to read the content of the websites visited.
- AI features in approved SaaS applications — an assistant in the CRM, the project management tool or the office suite, switched on by the vendor in an update, sometimes by default.
- Meeting note assistants — bots that join video calls and transcribe conversations, often with access to the whole team’s calendars.
- Applications with OAuth access — tools to which an employee granted access to mail, files or the calendar in the company identity directory with a single “Allow” click.
The last two forms are the hardest to spot, because they require neither an installation nor a visit to a new website. An OAuth integration runs on the vendor’s side, server to server, so it leaves no trace in proxy logs or in the company’s network traffic. The trace is kept elsewhere: the consent granted to the application is recorded in the identity directory, among the permissions of enterprise applications. Detection based solely on network traffic therefore always underestimates the scale of the phenomenon.
The scale can be large. In the 2024 Work Trend Index by Microsoft and LinkedIn, published in May 2024, the clear majority of AI users said they bring their own AI tools to work. These are survey data from more than two years ago, not a measurement in any particular company, but they show well where to start: from the assumption that the list of tools known to IT is incomplete.
Why is shadow AI a risk to data and compliance?
Shadow AI is a risk because company data reaches a party with which the company has no contract, on terms nobody has checked. The consequences fall into four areas.
The first is personal data protection. When a prompt contains customer or employee data, the tool vendor in practice processes it on the company’s behalf. Article 28(1) of the GDPR requires the controller to use only processors providing sufficient guarantees to implement appropriate technical and organisational measures. Such guarantees cannot be demonstrated for a tool the company does not know exists and with which it has signed no data processing agreement.
The second is trade secrets. Article 11(2) of the Polish Act on Combating Unfair Competition (consolidated text: Journal of Laws 2026, item 85) treats information as a trade secret only if the entitled party, exercising due diligence, has taken steps to keep it confidential. Having no rules for AI use and no knowledge of where documents end up weakens that argument in a potential dispute. This is our risk assessment, not the result of case law — but it is worth presenting to the board and the legal team.
The third area is contractual obligations. Non-disclosure agreements and clauses in customer contracts often prohibit disclosing information to third parties without consent, and pasting a customer document into a public AI tool may be such a disclosure. The fourth is technical security: an extension that can read every page and an OAuth application with mailbox access are also attack paths. A compromised extension sees everything the user sees.
Key takeaways:
- Shadow AI is a data flow problem, not just a list of unapproved applications.
- OAuth integrations and AI features in approved SaaS leave no trace in proxy logs.
- Without knowing the tools, the company can demonstrate neither the guarantees required by Article 28 GDPR nor due diligence in protecting trade secrets.
How do you detect shadow AI in DNS logs, proxy logs and a CASB?
The fastest route to shadow AI detection is network traffic: DNS, proxy and web gateway logs show who connects to AI services, how often and with what volume. It is a source most companies already have and rarely analyse from this angle.
Start with a list of domains of popular AI services and the queries for them in the DNS resolver over recent weeks. Group the results by department and compare them with proxy data, which shows the volume of data sent and received. A large volume sent to an AI service suggests file uploads rather than single questions — that is the first candidate for a conversation with the team.
A CASB automates this work. Microsoft Defender for Cloud Apps, for example, compares traffic logs against its cloud app catalog, which includes a “Generative AI” category — apps that generate text, images and video using generative AI models (Microsoft Learn, page dated July 2026). On the discovered apps page you can filter results by category, risk score, compliance and usage, and save your own query. Other CASB and SSE platforms have similar categories, but their names and scope depend on the vendor — check them in your tool’s documentation. The architectural background is described in the article on Security Service Edge.
Remember a limitation the vendor states in the same documentation: by default, Defender for Cloud Apps cannot discover apps that are not in its catalog. New and niche AI tools therefore also have to be searched for manually in raw DNS logs, for example by domain name patterns typical of model APIs.
Network traffic will not show everything either. Personal phones and home networks are outside the reach of the company proxy, encryption hides the content of requests, and OAuth integrations and AI features in SaaS applications do not pass through the employee’s device. That is why network logs are the first step, not the only one.
How do you find browser extensions, OAuth applications and AI features in SaaS?
These three forms of shadow AI are detected in administrative consoles, not in network logs. Each needs a separate review.
You will find browser extensions in the inventory of your endpoint or browser management tool. Microsoft Defender Vulnerability Management has a browser extensions assessment that shows the extension, the number of devices, the requested permissions and the risk level of those permissions (Microsoft Learn, July 2026). Look for extensions with AI features that are allowed to read and change data on all websites — they see the content of mail, the CRM and documents in the browser.
You can check OAuth applications in the identity directory. In Microsoft Entra ID, the review of permissions granted to enterprise applications shows what employees and administrators have approved and lets you revoke those consents (Microsoft Learn). For the future, it is worth restricting user consent, for example to apps from verified publishers and low-impact permissions, and enabling the admin consent workflow, so that an employee can request approval instead of looking for a workaround (Microsoft Learn).
AI features in SaaS applications require a review of the admin panels of key systems — the CRM, the office suite, project tools and video conferencing — as well as release notes and changes to data processing terms. The control question is: is the new feature on by default, and does data go to an external model provider?
The last source is people and finance. A short, anonymous survey — which tools do you use and for what — and conversations with team leads give you information no log will show: what task the tool serves and what an approved alternative must not make harder. A review of spending on company cards and in expense reports reveals paid subscriptions bought outside procurement.
How do you reduce shadow AI without blocking work?
You reduce shadow AI effectively when the approved route is easier than the workaround. A block on its own works only briefly, because it moves traffic to where the company can no longer see it.
The first element is an approved alternative: an AI tool available on company accounts, with single sign-on and verified data processing terms. The second is clear rules — an AI acceptable use policy says which tools may be used, which data must not be entered into them and who approves new tools. The third is control of the data itself, that is DLP controls for AI tools, which warn or block when sensitive information is pasted or uploaded.
Use blocking selectively. In the CASB, mark apps as sanctioned or unsanctioned; in Defender for Cloud Apps, apps tagged as Unsanctioned can be monitored or blocked, and after integration with Defender for Endpoint their domains are pushed to endpoints and blocked by network protection (Microsoft Learn, July 2026). The same integration has a gentler mode that only warns the user. A warning with a link to the approved alternative usually teaches more than a bare block.
The last element is a request route: a simple form saying “I want to use tool X for task Y”, with a decision within a few working days. If a decision takes weeks, employees will go back to workarounds. The practical rule: block what is high risk and has no business justification, and send everything else to the approval route.
Key takeaways:
- An approved alternative and a fast request route reduce shadow AI more effectively than bans.
- Block selectively: high-risk tools without a business justification.
- Warning mode with a link to the approved tool changes habits without stopping work.
How do you measure progress in reducing shadow AI?
Progress is measured with a few indicators tracked every month, not with a one-off inventory report. The indicators should show whether traffic is moving to approved tools, not only how much has been blocked.
A practical set includes: the number of AI apps discovered and the share of those that already have a decision (approved, restricted, blocked); the share of traffic to AI services from company accounts versus personal accounts; the number of OAuth applications with access to mail and files and the number of revoked consents; the number of tool approval requests and the time to decision; and the number of DLP warnings and blocks on AI services.
Beware of the indicator that misleads: the number of blocks. A drop may mean the problem has shrunk, but equally that employees have moved to personal phones. That is why you should always read a drop in blocks together with growth in the use of the approved tool. If there are fewer blocks and the approved tool sits empty, shadow AI has not disappeared — it has simply left the measurement.
What does a 30-day shadow AI detection plan look like?
A one-month plan splits the work into four weeks: network traffic, administrative consoles, people and decisions. The table shows what to do in each week, where to get the data and what should come out of it.
| Week | Action | Data source | Output |
|---|---|---|---|
| Week 1 | Inventory of AI services from network traffic; list of domains and categories | DNS resolver, proxy or web gateway, CASB | List of AI apps with departments and data volume |
| Week 2 | Review of extensions, OAuth consents and AI features in key SaaS applications | Endpoint console, identity directory, SaaS admin panels | List of integrations with access to company data |
| Week 3 | Survey and team conversations, spending review, risk assessment of each app | Survey, company card statements, vendor terms | Decision register: approve, restrict or block |
| Week 4 | Decisions, request route, first warnings and blocks, metrics baseline | CASB, identity directory, AI use rules | Baseline metrics and a monthly review plan |
After a month, the decision register matters most. It turns a one-off inventory into a process: every new AI app detected in the logs or reported by an employee goes into the same register and receives a decision based on the same criteria.
How can nFlo help with a shadow AI assessment?
If your company lacks the people to collect and assess this data for a month, nFlo carries out a shadow AI assessment and AI use policy. The service covers an inventory of AI tools based on DNS, proxy and CASB logs, a risk assessment of data flows, a review of existing DLP controls and a draft of the rules for AI use.
The assessment is part of the wider area of AI security, where cybersecurity meets governance, risk and compliance. You will find further articles in the AI security knowledge base, including the risk and control map for enterprise AI environments. Want to start with an inventory? Contact us.
What else is worth knowing about shadow AI detection?
Can you detect shadow AI without a CASB?
Yes. DNS and proxy logs, the browser extension inventory, a review of OAuth consents in the identity directory, an employee survey and a spending review give you the first picture. A CASB speeds the work up and adds an app risk assessment, but it is not a precondition for starting the inventory.
Does blocking ChatGPT solve the shadow AI problem?
No. Blocking one domain shifts traffic to other services, to personal phones and home networks, and it does not cover AI features in approved applications or OAuth integrations. Blocking makes sense for high-risk tools, but only together with an approved alternative and a route for requesting new tools.
Does analysing AI use violate employee privacy?
Analysis of business traffic to AI services should have a defined purpose, scope and data retention period. Agree the scope with the data protection officer and the legal team, and tell employees what the company checks and why. Data aggregated by department is usually enough for the risk assessment.
How often should you repeat the shadow AI inventory?
Track the metrics every month, and repeat the full review of extensions, OAuth consents and AI features in SaaS applications every quarter and after every major change, for example when the vendor of a key application switches on a new AI feature.
Who in the company is responsible for reducing shadow AI?
The process is most often led by the security team or the CISO, but decisions need IT, the legal team, the data protection officer and the business process owners. The security team supplies the data and the risk assessment, and the process owner decides whether the tool is needed.
