Shadow AI discovery: how to find every unsanctioned AI tool and agent
What shadow AI is, the four ways to detect it, where each method goes blind, and the layer most tools forget: who has access.
Every week your company adopts more AI. Some of it goes through IT. Most of it does not. An employee signs up for an AI note-taker with their work email, a team wires an AI agent into Salesforce, a developer points code at an LLM API. None of it appears on an asset list, and all of it can reach company data. That is shadow AI, and discovering it is now a core security problem.
This guide explains what shadow AI discovery actually involves, compares the detection methods honestly, and shows why finding the tools is only half the job.
What is shadow AI discovery?
Shadow AI discovery is the process of finding and cataloging every AI tool, app, and agent in use across your organization that was never formally approved, together with who is using each one and what data it can reach. A complete picture includes three things people often conflate:
- Standalone AI apps employees sign up for (ChatGPT, Claude, Perplexity, AI writers and note-takers).
- Embedded AI features switched on inside tools you already run (Copilot, Agentforce, AI in your CRM or helpdesk).
- AI agents and integrations that act on their own and connect to your systems through OAuth or API keys, often as non-human identities no one owns.
An inventory that only lists sanctioned tools misses the long tail, which is exactly where the risk lives.
Why shadow AI is a real risk, not a buzzword
The concern is not that people use AI. It is that no one can answer basic questions about it: which tools touch customer data, who connected that agent, what it is allowed to do, and who would notice if it went wrong. Sensitive data flows into third-party models with no data processing agreement, agents accumulate standing access that outlives the project, and an offboarded employee's AI connections quietly keep working. You cannot govern what you cannot see.
The four shadow AI detection methods, compared
There is no single feed that lists every AI tool. Each method sees part of the picture and misses the rest.
| Method | How it works | Blind spot |
|---|---|---|
| Email and OAuth | Read-only scan of your identity provider (Google Workspace, Microsoft 365) for signup, billing, and OAuth-grant signals from AI apps. | Tools used without an email trail or OAuth grant; pure on-device use. |
| Browser | An extension or endpoint agent watches traffic to known AI services in real time. | Needs deployment on every device; unmanaged and personal devices slip through. |
| Network | A CASB or proxy inspects traffic to known AI domains. | Off-network and encrypted use; agents that generate no obvious web traffic. |
| SaaS API | Connects to apps you know about and reads their app-to-app and AI integrations. | Only sees apps you already connected; misses the unknown unknowns. |
This is why serious discovery combines methods. Any single approach leaves a category of AI invisible, and the invisible category is usually the agents.
The layer most tools miss: access and ownership
Finding the tools is the easy half. The question a security team actually has to answer is: who has access, what data can it reach, and who owns it? A list of 200 AI apps with no access or ownership context is not governance, it is a longer to-do list. Inventory becomes useful the moment each entry is tied to its users, its permissions, the data it can touch, and a named owner who is accountable for it.
This is the gap Caspian is built to close. It is the AI-native software intelligence platform: instead of stitching together a discovery tool, an identity tool, and a security tool, you get one live map of every tool, identity, and AI agent, what each one can access, and who owns it. And because it is AI-native, you do not dig through dashboards, you ask it in plain language and get the answer in seconds. For the agent-specific version of this problem, see AI agent inventory.
How to start
- Pick a discovery approach that combines at least email or OAuth with one runtime method, so you catch both signups and live use.
- For every tool found, capture users, permissions, the data it can reach, and an owner. Stop at a flat list and you will not change anything.
- Triage by data sensitivity and access scope, not by tool count. A single over-permissioned agent can outrank fifty harmless apps.
- Make it continuous. Shadow AI is added every week, so a one-time audit is stale on arrival.