What is shadow AI and how do you find it in your company?

Shadow AI is the use of AI tools, models or agents inside an organization without the knowledge or approval of security, legal or IT. The main risk is data: staff paste confidential material into services nobody has reviewed. The fix starts with finding the use, then offering an approved option people will actually choose.

Why does shadow AI happen?

Because it is useful and nearly free to start. A person with a deadline opens a chat assistant in a browser tab, an engineer installs an AI plugin in an editor, a team connects an agent to a shared drive. None of these needs a purchase order. Calling it misbehavior misses the point. It is a signal that the approved route is slower than the unapproved one.

What is actually at risk?

The OWASP Gen AI Security Project describes sensitive information disclosure as covering personal data, financial details, health records, confidential business data, security credentials and legal documents. It notes that LLMs embedded in applications risk exposing sensitive data through their output, and that consumers need to understand the risk of unintentionally providing sensitive data that may later be disclosed. OWASP also says restrictions placed in a system prompt may not always be honored and could be bypassed via prompt injection.

Three kinds of exposure follow, in plain terms. Data leaves your boundary when someone pastes it into a tool. Data may be retained or reused under terms nobody read. And an AI tool with access to your systems can take actions, not just answer questions, which OWASP covers separately under excessive agency.

What does a governance framework say about it?

The NIST AI Risk Management Framework has four functions: Govern, Map, Measure and Manage. Within Govern, subcategory 1.6 says mechanisms should be in place to inventory AI systems, resourced according to organizational risk priorities. You cannot govern what is not on a list, and shadow AI is, by definition, what is missing from the list.

A constructed example

A finance team of eight uses a free AI summarizer to speed up contract review. Nobody told security. During a vendor questionnaire, the company has to answer whether customer contracts are sent to third party AI services, and no one can answer. The review finds the tool, the team explains why they needed it, and security finds an approved assistant under a data processing agreement that meets the same need. The team moves over in a week because the approved tool is no harder to use. A ban without that alternative would have sent the same work to a personal phone.

How to find it without a witch hunt

Start with sources you already have: network or proxy logs for known AI domains, browser extension inventories, expense and procurement data for subscriptions, single sign on logs showing "sign in with" grants to AI apps, and a short anonymous survey asking what tools people use and why. Each source covers a blind spot in the others.

How to check or apply this

1. Publish a simple, readable AI use policy: what data may go where, in one page.
2. Build an inventory of AI tools, models and agents, with an owner and a data classification for each, following NIST AI RMF Govern 1.6.
3. Check logs, extensions, expenses and sign in grants for AI services not on the inventory.
4. Run an amnesty survey and treat answers as requirements, not confessions.
5. Offer at least one approved assistant, with contract terms you have read.
6. Limit what any agent can reach: least privilege on data and on actions.
7. Revisit every quarter. The tool list changes faster than policy.

Safeguard's agent identity, MCP Guardrail and asset discovery capabilities are designed for the agent side of this problem: knowing which agents exist and controlling what they may call.

Quick check

Sources

• OWASP Gen AI Security Project: LLM02:2025 Sensitive Information Disclosure
• OWASP Gen AI Security Project: LLM06:2025 Excessive Agency
• NIST AI Risk Management Framework (AI 100-1)

Last reviewed: 18 October 2026.