Shadow AI is not a future risk. It's a present one, and it's almost certainly already operating inside your environment. Employees across every function, engineering, clinical, finance, legal, operations, are using AI tools they found, found useful, and started using without going through IT or security. They didn't intend to create a compliance problem. They were trying to do their jobs better. But the data flowing through those tools doesn't care about intent.
Understanding shadow AI starts with understanding how it differs from the shadow IT problem security teams have managed for years.
Why Shadow AI Is Different From Shadow IT
Shadow IT, employees using Dropbox instead of SharePoint, or Slack instead of the approved messaging platform, is a data governance and compliance problem. Shadow AI is all of that, but with a different risk profile. The difference lies in what these tools actually consume and what they do with it.
When an employee pastes a section of source code into a public AI assistant to get help debugging it, that code is potentially in the model's context, potentially logged by the vendor, and potentially subject to the vendor's training data policies. When a clinical coordinator uploads a patient discharge summary to an AI summarization tool, that PHI has left your environment through a channel you didn't approve and may not even know exists. When a legal associate feeds a draft acquisition agreement into an AI drafting assistant, your confidential deal terms are now in someone else's infrastructure.
The sensitivity of the data AI tools typically consume, code, contracts, proprietary documents, customer records, makes this a categorically different risk than an employee using an unapproved project management tool.
What We Find in Discovery Engagements
In a recent engagement with a mid-sized healthcare organization, we surfaced 34 unsanctioned AI tools in active use across clinical operations, billing, and IT. Three of them had terms of service that explicitly permitted training on uploaded content. None had been reviewed by legal or security. None appeared in the third-party vendor inventory.
In a separate engagement with a financial services firm, we found that developers on the engineering team were routinely pasting connection strings, internal API endpoints, and database schemas into a public AI coding assistant. The tool's enterprise tier, which would have disabled training, was available for a modest per-seat fee. The consumer tier they were using had different data handling commitments entirely.
These aren't edge cases. They are the norm in organizations that haven't built a shadow AI discovery and governance process.
"The answer to shadow AI is not blocking. Blocking tools employees find productive creates a cultural problem, pushes usage to harder-to-detect channels, and doesn't address the underlying need. The answer is governing."
How to Find What You Don't Know About
Shadow AI discovery requires looking in multiple places because employees access these tools through multiple channels:
- SSO logs: If your IdP handles SSO for SaaS applications, any AI tool integrated via SSO will appear in access logs. Many won't be, employees often sign up with personal credentials, but enterprise-tier tools frequently use SSO.
- Browser extension inventory: AI browser extensions (writing assistants, summarizers, coding helpers) are often invisible to traditional asset management. An endpoint management platform that can enumerate installed browser extensions will surface a significant portion of the AI footprint.
- SaaS spend data: Finance-connected SaaS management tools (Productiv, Torii, Zylo) can identify AI tool subscriptions charged to corporate cards or expensed by employees, even when IT wasn't involved in the purchase.
- Network traffic analysis: DNS logs and proxy logs will show traffic to known AI provider domains. This catches tools that bypass SSO entirely.
No single method captures the full picture. A comprehensive discovery effort combines at least three of these approaches and produces an inventory that most organizations find surprising in its breadth.
The Data Exposure Risk
Once you have an inventory, the next question is what data has been exposed through each tool. This is where the OWASP LLM Top 10's LLM03 (Supply Chain) risk category becomes directly relevant. Your AI tool vendors are third parties with data access. Their security posture, their data retention policies, their training data practices, and their breach history all affect your risk profile.
Key questions for every tool in your inventory:
- Does the vendor train on user inputs? If so, what opt-out mechanisms exist?
- How long does the vendor retain conversation data and uploaded content?
- What data processing agreements are in place, and are they sufficient for the data types employees are actually submitting?
- Does the vendor have an enterprise tier with materially different data handling commitments?
- What is the vendor's incident notification posture? Would you know if they had a breach that included your data?
The Right Response: Inventory, Classify, Govern
The goal isn't to eliminate AI tool use. Employees using AI tools productively are gaining real efficiency. The goal is to ensure that productivity isn't being purchased with data exposure you don't know about and can't manage.
A functional response to shadow AI has three phases:
- Inventory: Know what's in use. Use the discovery methods above. Get to a complete picture before making any blocking or approval decisions.
- Classify: Not every tool in the inventory is equally risky. A grammar assistant that processes text locally is different from an AI that processes uploaded documents with a cloud API. Risk-classify your inventory before deciding what to do with it.
- Govern: Build a process for approving AI tools quickly, communicating the approved list clearly, and handling new tool requests in a way that doesn't force employees into shadow channels. The tools that can be approved should be approved, ideally on enterprise tiers with appropriate data handling commitments. The ones that can't should be blocked with a clear explanation of why and an approved alternative.
Shadow AI doesn't go away by ignoring it. It grows. The organizations that get ahead of it now are the ones that will be able to adopt AI confidently, govern it transparently, and demonstrate that governance to auditors and regulators when the question comes, and it will come.