How to Detect Shadow AI: A Security Team's Discovery and Triage Playbook

Finding shadow AI is like tracing a leak in an old building. The puddle is obvious, but the water travels inside the walls. You find the source only by checking several places at once. This playbook shows security teams how to detect shadow AI, triage what they find by real risk and contain the dangerous cases quickly, without driving usage out of sight.

Shadow AI takes five shapes

Shadow AI is any AI tool, feature or connection used for work without review by security, legal or IT. Most organisations have all five shapes at once.

• Browser chat tools: staff paste documents, code or customer records into personal accounts.
• Connected apps: note-takers and writing tools granted OAuth access, a delegated sign-in permission, to mail, calendars or files.
• Extensions and desktop apps: add-ons that read every page, and assistants with access to local files.
• Embedded features: AI switched on inside approved software by an admin toggle or a product update.
• Developer usage: model API keys in code, and models run locally on laptops.

The causes are ordinary. AI tools are cheap, quick to adopt and faster than most approval routes. Microsoft and LinkedIn's 2024 Work Trend Index found 78% of AI users bring their own AI tools to work. A Gartner survey of 302 cybersecurity leaders, reported in November 2025, found 69% of organisations suspect or have evidence of prohibited public generative AI use.

The consequences are measurable. IBM's 2025 Cost of a Data Breach research found that high levels of shadow AI added about USD 670,000 to the average breach cost.

Combine six signals, because none sees everything

Each signal catches one shape of shadow AI and misses another, so use at least four. Teams relying on network logs alone see the chat tools but miss the connected apps, which carry the most risk.

Start with identity. A blocked website stops pasting, but it does nothing about an app that already holds a token to read every email. Export OAuth grants to unapproved apps and sort them by permission, with mail, file and send rights at the top.

Then shrink the problem at source. Restrict user consent to low-risk permissions from verified publishers, and route broader requests to a named admin reviewer. Use network logs to measure upload volume, not merely visits.

Triage by real risk, not by count

Discovery produces a long list. Treating every item as an incident wastes effort and teaches staff to hide usage. The prudent course is to score each finding on data sensitivity, access depth, provider terms and spread.

Consider a hypothetical firm of 900 staff. In one week, OAuth grants, proxy logs, extension inventories and a survey surfaced 41 AI tools. One note-taker, granted by 37 users, stored client call transcripts under terms that allowed training. Its tokens were revoked that day, and users moved to a feature the firm already licensed. The firm ended the week with a ranked list rather than 41 alarms.

Contain without driving usage underground

Blocking is a tool, not a strategy. Staff who need AI will move to personal phones, where security has no signal at all. Pair every block with a route.

• Sanctioned alternative: an approved assistant with enterprise terms, single sign-on and audit logs.
• Targeted blocks: block consumer sign-ins on managed devices, not the whole category.
• Plain reasons: name the specific risk in two lines rather than linking to a policy.
• Fast exceptions: one form, a named reviewer and a decision within five working days.

Finally, run discovery as a standing control. NIST's Cybersecurity Framework 2.0 places asset management under its Identify function, so record AI tools in that inventory. Agents with standing access deserve particular care, and the OWASP Top 10 for LLM Applications 2025 lists excessive agency as a distinct risk. Check new OAuth grants weekly and repeat the survey quarterly.