Why shadow AI is different from shadow IT
Shadow IT used to mean unsanctioned SaaS apps. Shadow AI has two properties that raise the stakes. The data flowing in is often the most sensitive data people work with — they ask AI for help with the hard, confidential tasks. And AI tools increasingly connect to other systems through OAuth, so a single click can give a third-party AI app ongoing access to a mailbox or drive.
Seven discovery sources
1. OAuth grants in your identity platform
Google Workspace and Microsoft Entra ID both record third-party apps users have authorized and the scopes granted. Export the list, filter for AI-related apps, and note the scopes — mail read, drive read/write, and calendar are the most sensitive. This is usually the highest-value source.
2. SSO sign-in logs
Sanctioned apps appear here; unsanctioned apps using "Sign in with Google/Microsoft" often do too.
3. Expense and card data
Search expense reports and corporate card transactions for AI vendors. Individual subscriptions expensed as "software" are common.
4. Browser extensions
Managed browsers can report installed extensions. AI writing and meeting assistants often run as extensions with permission to read every page the user visits.
5. Network and DNS data
Secure web gateways and DNS filters can show traffic to AI domains. Use it to measure volume, not to read content.
6. Code and secrets scanning
Search repositories for AI provider SDKs and API keys. Keys found in code are both a discovery signal and an immediate credential finding.
7. Ask people
A short, non-punitive survey per department — "Which AI tools do you use for work, and for what?" — surfaces tools no log will show, especially on personal devices.
Triage what you find
| Situation | Action |
|---|---|
| Useful tool, business plan available | Review the vendor, move users to an administered plan, approve |
| Useful tool, no acceptable terms | Provide an approved alternative; set a migration date; revoke grants |
| Tool connected with broad OAuth scopes | Revoke or narrow scopes; restrict user consent |
| Sensitive data already shared | Assess exposure with privacy/legal; request deletion from the vendor if possible |
| API key found in code | Rotate immediately; move to secrets manager |
| Personal account used for work | Migrate to the approved workspace; have the user delete work content |
Prevent recurrence
- Publish an AI acceptable-use policy that names approved tools.
- Offer an approved tool for the most common use cases.
- Restrict user consent to third-party apps so new OAuth grants need admin approval.
- Create a lightweight request process for new AI tools with a fast turnaround.
- Repeat discovery quarterly.
Record everything you find in your AI inventory. The FlashTower Scan and AI Inventory give you a structured place to keep it, with risk rules applied to each system.
Communicating with employees
How you run discovery shapes whether people cooperate next time. Announce the effort before you start, explain that the goal is to provide approved tools and protect data, and say explicitly that there will be no penalty for disclosing current use. Share what you found in aggregate, and what you are doing about it — especially the tools you are approving.
Pair discovery with a fast path to approval. If the average request takes three months, employees will keep using unapproved tools. A target of one to two weeks for low-risk tools is realistic with a tiered vendor review.
Measuring progress
- Number of AI apps with active OAuth grants, and the share that are approved.
- Number of users on approved AI tools versus total AI users identified.
- Number of AI API keys found in code (target: zero).
- Time from new-tool request to decision.
Reading OAuth scopes
When you export third-party app grants, the scopes tell you what each AI app can actually do. Prioritize review by scope, not by app name:
| Scope pattern | What it allows | Priority |
|---|---|---|
| Full mail access (read, send, delete) | Read every email; send as the user | Highest |
| Drive / OneDrive / SharePoint read-write | Read and change any file the user can access | Highest |
| Mail read-only | Read every email, including confidential threads | High |
| Drive read-only | Read every file the user can access | High |
| Calendar | Meeting titles, attendees, and often dial-in links and notes | Medium |
| Basic profile / email address | Sign-in only | Low |
An AI meeting assistant with calendar access and a note-taker that joins calls can collect a great deal of confidential information even though its scopes look modest. Consider what the app does with the access, not only the scope string.
Frequently asked questions
Should we block all unapproved AI tools?
Blocking without an approved alternative tends to move use to personal devices. Most organizations get better results by approving a managed tool, restricting OAuth consent, and monitoring.
Is monitoring AI usage legal?
Monitoring rules vary by jurisdiction and employment context. Focus on metadata (which tools, how much) rather than content, and consult counsel and HR before deploying monitoring.
What counts as shadow AI?
Any AI tool, AI feature, or AI agent used for work without review by IT, security, or the relevant owner. That includes personal accounts on approved products, browser extensions with AI features, AI features switched on inside existing software, and automations built by business users that call AI models.
How often should shadow AI discovery run?
Run a full discovery once to establish a baseline, then repeat the OAuth-grant and expense checks quarterly. Once user consent to third-party apps is restricted, new AI grants appear as admin approval requests instead, which makes ongoing discovery much easier.