Shadow AI is any AI tool, model, or agent used in your organization without IT approval or security review. It includes browser chatbots, AI browser extensions, coding assistants, locally run models, and AI features switched on by default inside approved software.
To detect it, run five steps as a continuous loop: find the AI tools in use, learn what normal use looks like, rank interactions by risk, respond in proportion, and keep monitoring. A one-time scan is not enough, because new AI tools appear every week and a snapshot goes stale fast.
Key takeaways
- Find every AI tool in use across your network, browsers, identity systems, SaaS apps, and endpoints.
- Learn what normal AI use looks like for each role, so unusual use stands out.
- Rank interactions by risk: what data was involved, who used the tool, and where the data went.
- Respond in proportion: monitor, warn, block, or escalate, and give employees an approved alternative.
- Keep monitoring, and report a few simple metrics to leadership.
- Network and DNS traffic to known AI domains and model APIs
- Browser extensions and web AI apps, including tools used with personal logins
- OAuth and SSO grants that give AI services access to Microsoft 365, Google Workspace, or Slack
- AI features inside approved apps, such as Copilot, Gemini, or Salesforce Einstein
- Endpoint activity, which finds locally run models (such as Ollama and LM Studio), IDE plugins (such as GitHub Copilot and Cursor), and AI use on off-network and BYOD devices
- Tools that do not fit a person's role
- Use outside normal hours or from an unmanaged device
- Sudden large content transfers to an AI tool
- Sensitive or confidential files opened just before an AI session
- Bulk copy and paste into a public or unvetted AI tool
- High-access users on tools with weak data-retention terms
Step 1: find every AI tool in use
No single method catches everything, so check several places and combine what you find into one inventory. Together these channels cover most shadow AI:
No single method catches everything, so check several places and combine what you find into one inventory. Together these channels cover most shadow AI:
What to look for
Step 2: learn what normal AI use looks like
Discovery tells you which tools are in use. This step tells you whether a given use is normal. Watch each role for 30 to 90 days and note which tools people use, how often, at what hours, and in what volume. Daily Copilot use by an engineer during working hours is normal. A finance analyst uploading PDFs to a public chatbot at 11 p.m., when no one in that team has used AI before, is not.
What to look for
Step 3: rank interactions by risk
Not every AI interaction is a problem. Ranking by risk keeps analysts focused on real exposure. A risk score combines a few signals: how sensitive the data was, whether the user normally handles that data, how much content moved, and how the destination tool handles submitted data (for example, whether it keeps it for model training).
What to look for
Correlating these factors, rather than firing a siloed alert on any single one, produces a unified risk score that reflects the actual likelihood and severity of exposure. This is also where shadow AI detection intersects with broader insider risk management: a high-risk AI interaction rarely occurs in isolation. It often co-occurs with other early warning indicators (resignation activity, access anomalies, off-hours file access), and DTEX's correlation model is built to surface those combinations rather than treat shadow AI as a standalone alert category.
Step 4: respond in proportion to risk
Match the response to the risk:
- Monitor only for low-risk, normal activity
- Warn the user with a short in-the-moment coaching prompt for moderate deviations
- Block high-risk, policy-violating actions
- Escalate to HR or legal when the pattern shows deliberate data theft or repeated circumvention
Blocking alone backfires. Employees who lose a tool they rely on move to personal devices and accounts, which pushes the behavior further out of sight. Publish a list of approved AI tools, give people a fast way to request new ones, and keep blocks for the cases that warrant them. Policy triggers can be built on file tags, activity sequence, and provenance rather than reading every keystroke, which protects employee privacy.
Sample policy trigger: alert when a user copies content from a file tagged "Confidential" and pastes it into a public AI tool in the same session.
Step 5: Continuous monitoring and program maturation
Shadow AI is not solved by a single audit. Treat the first four steps as a feedback loop: the inventory updates as new tools appear, normal-use patterns shift as roles change, and risk rankings adjust as vendors change their data terms.
Report three metrics to leadership:
- AI tool sprawl: the number of distinct AI tools and vendors in active use
- High-risk interaction rate: how many interactions are above your high-risk threshold, and the trend
- Policy trigger frequency: how often warnings and blocks fire
A timestamped log of AI tool use, risk scores, and enforcement actions also serves as compliance evidence. It supports audit trails under GDPR, HIPAA, and the EU AI Act, and aligns with the NIST AI Risk Management Framework.
See DTEX in action
DTEX builds this framework on DMAP+, which correlates data, metadata, activity, and provenance signals at the endpoint into a single forensic timeline. In the DTEX platform, AI tool discovery and normal-use learning run on endpoint telemetry, risk scoring draws on DMAP+ signals, and policy triggers handle the warn, block, and escalate tiers. See how the DTEX platform helps teams detect and mitigate insider risk with real-world context. Request a demo.
Frequently asked questions
Detect it through metadata, activity sequence, and provenance rather than reading prompts or documents. Endpoint telemetry shows which AI tool was opened, which file was accessed beforehand, how much content moved, and when, without scanning every keystroke. Policy triggers built on that pattern, such as copying from a file tagged "Confidential" and pasting it into a public AI tool, preserve privacy while catching the sequences that matter.
Rank the interaction, then respond in proportion to the risk. Low-risk, normal use stays in monitor-only mode. Moderate deviations warrant a coaching prompt, high-risk policy violations warrant a block, and signs of deliberate data theft or repeated circumvention should escalate to HR or legal. Add newly found tools to the inventory, review their data-handling terms, and offer an approved alternative where one exists.
Start with visibility, since you cannot govern AI use you cannot see. Then sort tools into three groups: approved and monitored, allowed with data-handling guardrails, and prohibited for regulated or highly sensitive data. Publish the approved list, give employees a quick way to request new tools, and review the policy regularly, because shadow AI adoption shifts quickly.
Not reliably. DLP and CASB tools inspect content against known data patterns, so they can flag traffic to a known AI domain but miss AI features embedded in approved apps, locally run models, browser-based plugins, and non-human identities acting autonomously. Free-text prompts also do not match signature patterns, and risk often depends on what happened before the prompt. DLP can complement shadow AI detection but cannot replace endpoint behavioral telemetry, which is where DTEX's DMAP+ closes the gap.
Last updated: October 18, 2026
