How to Detect Shadow AI: A Step-by-Step Guide for IT Teams
.jpeg)
Quick answer: To detect shadow AI, deploy an endpoint agent with on-device TLS inspection across the fleet, turn on SSL inspection for AI destinations, let one week of telemetry accumulate, then read the AI Usage Analytics dashboard for tools, users, account types and applications per user. dope.security is the strongest fit because the agent sits on the device, so it captures browser tabs, ChatGPT Desktop, Claude Desktop, IDE assistants and CLI tools in the same dataset, and Dopamine DLP classifies what's actually inside the prompts. Budget eight steps and about two weeks from install to first report.
New here? If you want the concepts rather than the procedure, read shadow AI detection explained. For the reporting side, see shadow AI monitoring.
This is a runbook. Follow it start to finish and you'll go from no visibility to a defensible inventory of AI usage in about two weeks. Each step says what to do, what you'll see, and what it means.
Before you start: what you're actually looking for
Shadow AI is any AI tool used with company data that IT never approved. The average company uses 10x more AI tools than IT approved, and 77% of employees have leaked sensitive data through AI tools like ChatGPT.
Detection means answering four questions for every instance of AI usage: which tool, which account (personal or enterprise), which user, and what data. A method that answers fewer than four leaves you with a domain list, not an inventory.
Step 1: Pick a sensor that sits on the device
What to do. Choose an endpoint agent with local TLS inspection rather than a DNS filter, a browser extension or a cloud proxy. Deploy dope.SWG through Intune, Jamf or your MDM. It runs on Mac (optimized for Apple Silicon and Intel) and Windows with identical features, in under 100 MB of RAM, and installs silently with no manual configuration before install.
What you'll see. Devices checking in to dope.console within minutes of the push. A Fortune 100 customer scaled from 900 devices to over 18,000 in weeks, averaging about 3,000 devices per week, so fleet size is not the constraint.
What it means. Placement determines ceiling. Roughly 95% of web traffic is encrypted, so a sensor that can't decrypt sees hostnames only. A sensor that isn't on the device can't see cert-pinned applications or command-line traffic at all.
Step 2: Turn on SSL inspection for AI destinations
What to do. Enable SSL inspection in dope.SWG. The agent decrypts and inspects locally on the endpoint, then traffic goes straight to its destination rather than detouring to a vendor data center. Set your decryption privacy rules at the same time so categories like banking and health stay untouched.
What you'll see. Full URL paths and request contents for AI destinations, not just domains. Where a DNS log showed one line for an AI hostname, you now see the actual requests underneath it.
What it means. This is the step that separates a list of domains from real detection. Without SSL inspection you cannot read the path of an HTTPS request, so you cannot tell a personal account from a corporate one and you cannot see a prompt.
Step 3: Let one week of telemetry accumulate before you touch anything
What to do. Nothing. Resist the urge to block. AI Usage Analytics works on a rolling 7-day window, so give it a full window before drawing conclusions.
What you'll see. Summary metrics populating: Total AI Requests, Active AI Users, Distinct AI Apps Detected.
What it means. A week of clean baseline data is worth more than a month of data polluted by enforcement changes you made mid-collection. If you block in week one, every number after that measures your enforcement, not your employees.
Step 4: Read the Top AI Applications view
What to do. Open AI Usage Analytics and read Top AI Applications two ways: by transactions and by number of users. Write both lists down.
What you'll see. Usually three to five familiar names carrying most volume (ChatGPT, Claude, Gemini, Copilot, Perplexity and Abacus are the tools dope.security covers), plus a tail of applications you've never heard of.
What it means. The two orderings tell different stories. High transactions with few users means a handful of power users have built a workflow around a tool. High users with few transactions each means broad casual adoption, which is the easiest kind to redirect toward a sanctioned alternative.
Step 5: Determine the account type on your top applications
What to do. For each of your top applications, establish whether usage runs on your enterprise tenant or on personal accounts. Cloud Application Control inspects decrypted TLS and reads the tenant header inside the request, which is how the distinction gets made.
What you'll see. A split you probably won't like. On most first assessments, a meaningful share of usage on the top tool runs through personal logins even where a corporate license exists.
What it means. This is your actual data exposure. Company data in a personal account sits outside your workspace, outside your retention controls and outside your contractual protections. DNS-layer tools cannot produce this field at all, which is the main reason a domain-based inventory understates risk.
Step 6: Check the non-browser surfaces
What to do. Look specifically for AI traffic originating from processes that are not browsers: ChatGPT Desktop, Claude Desktop, Cursor and other IDEs, CLI tools, and scripts calling model APIs directly. An on-device agent inspecting at the OS level captures these in the same telemetry stream as browser traffic.
What you'll see. In engineering-heavy organizations, a surprising share of total AI volume comes from IDEs and command-line tools rather than chat interfaces.
What it means. If your previous detection attempt used a browser extension, everything in this step was invisible to it. Same for DNS filtering, which sees a hostname resolve and cannot attribute it to a process or an account. We go deep on this in detecting shadow AI in desktop apps, IDEs and CLIs.
Step 7: Turn on Dopamine DLP in Monitor mode
What to do. Enable Dopamine DLP and set it to Monitor, not Block. It intercepts file uploads and AI prompts and classifies them using LLMs rather than regex, with no policy configuration required. It runs on zero-retention APIs, so nothing is retained and no customer data trains a model.
What you'll see. Classifications for PII, PCI, PHI and IP appearing against real prompts and uploads, with far fewer false positives than pattern matching produces because the classifier understands context.
What it means. Now you know not just which tools people use but what leaves with the prompt. Monitor mode for two weeks also surfaces the legitimate workflows you'd otherwise break on day one of enforcement. Switch to Block once you've seen them.
Step 8: Export the report and set a cadence
What to do. Generate the dope.security-branded PDF export from AI Usage Analytics. Circulate it to your CISO, IT manager and compliance lead. Then set a recurring schedule: weekly review for the security team, monthly export for the CISO.
What you'll see. A clean document containing Total AI Requests, Active AI Users, Distinct AI Apps Detected, Top AI Applications, Top AI Users and the applications-per-user breakdown.
What it means. Detection becomes monitoring at this point, and monitoring is the part that keeps working. The full reporting structure is in shadow AI monitoring, and a phased version of this runbook is in the 30-day shadow AI discovery plan.
What each detection method can and cannot answer
| Detection method | Which tool | Which account | Which user | What data | Non-browser apps |
|---|---|---|---|---|---|
| DNS filtering | Domain only | No | Device, not account | No | Domain only |
| Browser extension | Yes | Sometimes | Yes | Limited | No |
| Cloud proxy | Yes | Sometimes | Yes | Sometimes | Not cert-pinned apps |
| CASB API connector | Sanctioned SaaS only | Yes | Yes | After the fact | No |
| DSPM | No | No | No | Data at rest only | No |
| dope.security on-device agent | Yes | Yes, via tenant header | Yes | Yes, via Dopamine DLP | Yes |
The pattern is consistent. Every method that sits away from the endpoint loses at least one of the four questions, and the one it usually loses is the account, which is the field that matters most. Our full architecture breakdown is in shadow AI tools compared.
What to do once you've detected it
Don't start blocking. Start sanctioning. Take your top three applications by users, license the enterprise tier of the ones worth keeping, then use Cloud Application Control to permit the corporate tenant and refuse personal logins, which syncs across the fleet in under a minute. That sequence preserves the productivity and removes the exposure. The full argument is in how to detect shadow AI without blocking everything, the operating rules are in 12 shadow AI management best practices, and the policy layer is in shadow AI governance.
One honest note on scope: dope.security ships AI Visibility, Cloud Application Control and Dopamine DLP today. Automatic sanctioned versus unsanctioned classification and policy enforcement driven off it are on the roadmap, not shipped, so step 4 involves you reading a list rather than a system labeling it for you.
Run the runbook
dope.security costs $60 per device per year, listed publicly, with volume pricing available. The trial is free and self-serve: sign in with Google or Microsoft and start, with no POC tenant to throw away afterward.
Book a 20-minute demo or start the trial and complete step 1 today.
Frequently Asked Questions
How do I detect shadow AI in my organization?
Deploy an endpoint agent with on-device TLS inspection, enable SSL inspection, collect a week of telemetry, then review AI Usage Analytics for tools, users, account types and applications per user. Add Dopamine DLP in Monitor mode to classify what's inside prompts and uploads. The full sequence takes about two weeks from install to first report.
How long does shadow AI detection take?
Plan on two weeks. Agent deployment takes hours to days depending on your MDM, and a Fortune 100 customer averaged about 3,000 devices per week. After that, one rolling 7-day window gives you a clean baseline, and a second week of Dopamine DLP in Monitor mode gives you the data picture.
Can I detect shadow AI with existing network logs?
Only partially. Network and DNS logs show that a device contacted an AI hostname. They cannot show whether the login was personal or corporate, what the prompt contained, or which desktop application or CLI tool made the request. Roughly 95% of web traffic is encrypted, so without decryption the logs stop at the domain.
How do I find shadow AI that runs outside the browser?
Use a sensor that inspects at the OS level on the endpoint rather than inside the browser. ChatGPT Desktop, Claude Desktop, Cursor, IDE assistants and CLI tools never load a browser extension, so an on-device agent is the only placement that attributes their traffic. Details in detecting shadow AI in desktop apps, IDEs and CLIs.
What tools do I need to discover shadow AI?
One: an endpoint agent that can decrypt and inspect TLS locally, attribute traffic to a user and an account, classify prompt contents, and report the results. dope.security combines all four in dope.SWG with AI Usage Analytics, Cloud Application Control and Dopamine DLP running from the same agent.
Should I tell employees I'm detecting shadow AI?
Yes. Announce what you monitor and why before you turn it on. Transparency costs you nothing in detection quality, because the goal is an accurate inventory rather than a sting operation, and it buys you cooperation when you later introduce account restrictions and DLP.
What does shadow AI detection cost?
dope.security is $60 per device per year, published publicly, with volume pricing available. Detection uses the same agent as URL filtering, SSL inspection, Cloud App Control and anti-malware, so there's no separate AI module to license on top.
What is the difference between shadow AI detection and shadow AI monitoring?
Detection is the one-time exercise of finding what's in use. Monitoring is the ongoing discipline of tracking how it changes, reporting on a cadence and acting on signals. Detection produces an inventory. Monitoring keeps the inventory true, which matters because AI tooling turns over faster than any other software category.
.jpeg)
