.png)
DISCOVERY & INVENTORY
You can't govern the AI tools you don't know are in use.
Employees adopt free AI tools faster than IT can review them — a browser extension here, a personal ChatGPT account pasting in customer data there, a trial AI plugin added to a shared tool by one team. We find what's actually running before it becomes an incident.
HOW WE FIND IT
Four discovery methods, combined.
SaaS & spend review
Expense reports and SaaS subscription records surface tools paid for outside a formal procurement process.
Network & traffic review
Outbound traffic patterns reveal AI services in regular use that were never requested through IT.
Browser & extension audit
Installed browser extensions across managed devices are checked against a list of known AI tools.
Team interviews
Short conversations with team leads surface tools adopted informally that leave no clean paper trail.
WHAT HAPPENS AFTER DISCOVERY
The goal is a decision, not a ban.
Shadow AI discovery isn't about shutting every unsanctioned tool off on day one. Each tool found is reviewed for what data it touches and how it's actually being used, then sorted into one of three outcomes: approved and documented, replaced with a vetted alternative, or removed — with the reason for each decision recorded.