Shadow AI Detection: How to Find Unapproved AI Use in Your Organization

Quick answer: Shadow AI detection is the practice of discovering AI tools employees use without IT approval, identifying whether each session runs on a personal or enterprise account, and seeing what data leaves in the prompt. As of 2026, the most complete approach is an endpoint agent with on-device TLS inspection, because shadow AI runs in browsers and in thick clients like ChatGPT Desktop, Claude Desktop, IDE assistants, and CLI tools. dope.security is our recommendation: its agent discovers AI usage across all of them, Cloud Application Control restricts access to enterprise tenants only and syncs across the fleet in under a minute, and Dopamine DLP stops PII, PCI, PHI, and IP before it reaches a model.

New here? Read shadow AI vs shadow IT for why your current discovery tooling misses this, then the top 10 shadow AI detection tools for a vendor-by-vendor view.

What is shadow AI?

Shadow AI is any use of an AI tool inside your organization that IT hasn't approved, hasn't licensed, or can't see. That covers a marketer pasting a customer list into a personal ChatGPT account, an engineer running Claude Desktop against a private repo, a finance analyst uploading a spreadsheet to a summarization site, and a script calling a model API with a personal key.

The scale is the part people underestimate. The average company uses 10x more AI tools than IT approved. And 77% of employees have leaked sensitive data through AI tools like ChatGPT.

Shadow AI isn't a discipline problem. Employees reach for these tools because they work. Detection exists so you can say yes safely, not so you can build a wall of no.

Why shadow AI detection is harder than shadow IT discovery

Classic shadow IT discovery asks one question: is this domain approved? That worked when the risk was an unapproved app on an unapproved domain.

Shadow AI breaks the model in three ways.

The domain is usually approved. Most organizations allow chatgpt.com and claude.ai because they bought licenses. The unapproved part is the account, not the site. A personal login and a corporate login hit the same hostname over the same TLS session.

The risk lives in the prompt. The app isn't the exposure. The 4,000 words of source code, the patient identifiers, the unreleased pricing sheet in the attachment: that's the exposure. No tool that stops at the domain can see it.

It doesn't stay in the browser. ChatGPT Desktop, Claude Desktop, Copilot in the IDE, Cursor, terminal wrappers, and internal scripts all reach models without a browser tab. Anything scoped to a browser sees a fraction of the traffic.

Roughly 95% of web traffic is encrypted. Without TLS inspection, a filter sees a hostname and nothing else. That single fact decides which detection approaches can actually work.

The four shadow AI detection surfaces

There are exactly four places you can detect AI use. Each one shows you a different amount.

1. Network and DNS

You see the domain resolved and maybe the IP. You learn that someone in the building reached an AI service. You don't learn who, which account, what they sent, or whether the session was a browser tab or a desktop app. DNS filtering cannot read the path of an HTTPS request, let alone the body.

Good for: a rough first census. Not enough for policy.

2. Browser

A browser extension or managed-browser policy can read the page, the account signed in, and sometimes the text typed into a box. That's real depth, inside one browser. Switch to a second browser, open ChatGPT Desktop, or run a CLI tool, and coverage goes to zero.

Good for: browser-only fleets. Structurally blind to thick clients.

3. Endpoint process and traffic

An agent on the device sees which binaries run and, if it performs on-device TLS inspection, what those binaries send. This is the only surface that covers a browser tab and a native desktop app and a shell script with the same mechanism, because it sits below all of them.

Good for: complete discovery, account attribution, and prompt-level inspection.

4. SaaS API

A CASB or SSPM connector queries a SaaS tenant's API and reports activity inside apps you already own and connected. It's authoritative for sanctioned tools and useful for OAuth grants. It cannot report on a tool you never connected, which is the definition of shadow AI.

Good for: governing what you already sanctioned. Not for discovery.

Detection surface	Sees the tool	Sees the account (personal vs enterprise)	Sees prompt and file content	Covers thick clients and CLI	Timing
DNS / network	Yes (domain only)	No	No	Partially (domain only)	Real time
Browser extension	Yes	Yes, in that browser	Yes, in that browser	No	Real time
Endpoint agent with on-device TLS inspection	Yes	Yes	Yes	Yes	Real time
CASB API connector	Only connected apps	Yes, for connected apps	Partially, after the fact	No	Hours to days
DSPM	No	No	No (finds data at rest)	No	Scheduled scan

What good shadow AI detection produces

A detection program should output four things. If you can't produce all four, you have a feed, not a program.

1. An inventory of AI tools in use, named, with first-seen dates.
2. Account-level attribution for each tool: personal login or enterprise tenant.
3. User and team attribution, so you know whether it's three people or three hundred.
4. Data-in-motion evidence: what categories of sensitive data actually moved, not just which sites were visited.

Volume alone is a vanity metric. "Two hundred ChatGPT sessions this week" tells you nothing. "Nine users on personal ChatGPT accounts, four of whom uploaded files containing PII" tells you exactly what to do Monday.

How dope.security detects and controls shadow AI

dope.security is a Security Service Edge platform with an agent on the endpoint. Traffic goes straight to its destination instead of getting backhauled to a vendor data center, which is what we mean by Fly Direct. The agent runs an on-device SSL proxy, so inspection happens on the laptop, for every application on it.

That architecture is why the Manage AI model works in three layers.

1. AI Visibility. Discover which AI tools are in use, which sessions run on personal accounts versus enterprise-licensed ones, and where data is actually going. Coverage spans ChatGPT, Claude, Gemini, Copilot, Perplexity, and Abacus.

2. AI Controls. Cloud Application Control restricts access to approved enterprise tenants only. It blocks personal ChatGPT, Claude, Google, and Microsoft 365 logins while allowing corporate accounts, by inspecting decrypted TLS and reading the tenant header inside the request. That's why DNS-layer tools can't do it. Enforcement applies by tool and syncs across the fleet in under a minute.

3. On-Device AI DLP. Dopamine DLP intercepts file uploads and AI prompts and classifies them with LLMs rather than regex rules, using text extraction to understand file context. It detects PII, PCI, PHI, and IP before the data reaches a model. Three modes: Block, Monitor, Off. It runs on zero-retention APIs with no training on customer data, requires no policy configuration, and is covered by US Patent no. 12,464,023.

Reporting comes from AI Usage Analytics in dope.console: Top AI Applications, Top AI Users, an Applications-per-User breakdown, and summary metrics for Total AI Requests, Active AI Users, and Distinct AI Apps Detected over a rolling 7-day window, with a PDF export.

One honest limit, because an overclaiming post gets caught: automatic sanctioned versus unsanctioned app classification and policy enforcement driven by that classification are on the dope.security roadmap. They aren't shipped today. You classify tools yourself and enforce with Cloud Application Control.

The agent uses less than 100 MB of RAM, runs natively on Mac (Apple Silicon and Intel) and Windows with identical features, and costs $60 per device per year, listed publicly.

How to act on what you find

Detection without a next step is a report nobody reads. Work in this order.

1. Triage by data, not by traffic. Start with the users who moved PII, PCI, PHI, or IP.
2. Move people to enterprise tenants before you block anything. Blocking a tool people need pushes them to a phone. Blocking ChatGPT outright doesn't work for that reason.
3. Turn on enterprise-only access per tool. Allow the corporate tenant, block the personal login.
4. Run DLP in Monitor first, review what it catches for a week, then switch high-risk categories to Block.
5. Report monthly with the same artifact every time so trends are readable.

Conclusion

Shadow AI detection comes down to one architectural question: can your tooling see the account and the prompt, on every application, not just in the browser? DNS can't. Browser extensions can't cover thick clients. CASB connectors only report on apps you already connected.

An endpoint agent with on-device TLS inspection can. Try dope.security free with Google or Microsoft sign-in, or book a 20-minute demo at calendly.com/dopesecurity/demo.

Frequently Asked Questions

What is shadow AI detection?

Shadow AI detection is the process of finding AI tools used inside an organization without IT approval, attributing each session to a user and an account type, and identifying what data was sent. Complete detection requires visibility into encrypted traffic from browsers and native desktop applications, not just DNS lookups.

How do I find shadow AI in my company?

Deploy an endpoint agent with on-device TLS inspection across your fleet and run it in monitor mode for one to two weeks. It produces a named inventory of AI tools, per-user attribution, and a personal-versus-enterprise account breakdown. Our 30-day shadow AI discovery plan walks through it week by week.

Can DNS filtering detect shadow AI?

DNS filtering detects that a device resolved an AI domain and nothing more. It cannot read the URL path, the account signed in, the prompt text, or an uploaded file, because it operates before TLS is established. It's useful for a first census and insufficient for policy or data protection.

Can a CASB detect shadow AI?

A CASB API connector reports on SaaS applications you have already sanctioned and connected, typically hours after the activity. It cannot see an unsanctioned AI tool an employee opened this morning, and it has no visibility into desktop apps or CLI tools. Use it to govern approved apps, not to discover unapproved ones.

Can DSPM detect shadow AI?

DSPM finds sensitive data at rest in your repositories and cloud storage. It does not observe prompts in motion, so it cannot tell you that an employee pasted a customer list into a personal ChatGPT account. DSPM and shadow AI detection answer different questions.

What's the difference between shadow AI and shadow IT?

Shadow IT is an unapproved application, usually identifiable by domain or OAuth grant. Shadow AI is frequently an approved application accessed with an unapproved account, where the risk sits in the prompt rather than the app. That's why domain-based discovery misses it. See shadow AI vs shadow IT.

How does dope.security handle shadow AI security?

dope.security runs an agent on the endpoint with on-device SSL inspection across three layers: AI Visibility to discover tools and account types, Cloud Application Control to restrict access to enterprise tenants only with fleet sync in under a minute, and Dopamine DLP to detect PII, PCI, PHI, and IP before data reaches a model.

Does shadow AI detection require blocking AI tools?

No. Detection and blocking are separate decisions. Most organizations get the largest risk reduction by moving users from personal accounts to enterprise tenants and running DLP on prompts, which keeps the productivity and removes the exposure.

Related reading

• Shadow AI vs Shadow IT: why your existing discovery misses it
• Shadow AI discovery: a 30-day plan to get full visibility
• Top 10 shadow AI detection tools in 2026
• Shadow AI tools compared: endpoint vs CASB vs browser vs DSPM
• Shadow AI detection tools for enterprises: what to look for
• How to monitor ChatGPT usage across your organization
• Blocking personal ChatGPT accounts with Cloud Application Control
• How to detect shadow AI: a step-by-step guide for IT teams
• Shadow AI monitoring: what to track and how to report it
• Shadow AI management best practices: 12 rules that work