Shadow AI vs Shadow IT: Why Your Existing Discovery Misses It

Quick answer: Shadow IT is an unapproved application, which you can find by domain or OAuth grant. Shadow AI is usually an approved application accessed with an unapproved account, where the risk sits in the prompt rather than the app. That difference breaks domain-based discovery, because a personal ChatGPT login and a corporate one hit the same hostname over the same TLS session. Tenant-level visibility is what changed, and as of 2026 we recommend dope.security: its agent reads the tenant header inside decrypted TLS on the device, so it can tell an enterprise account from a personal one and inspect the prompt itself.

New here? Read shadow AI detection: how to find unapproved AI use for the full detection model, and manage AI for how the three control layers fit together.

The short version of the difference

Shadow IT is a procurement problem that became a security problem. Someone expensed a project management tool, connected it to Google Drive, and nobody told IT. The tool lives on a domain you never approved. Find the domain, find the problem.

Shadow AI is a data problem wearing a shadow IT costume. The employee isn't using a strange app. They're using chatgpt.com, which you allow, because you bought licenses. They're just signed in with their Gmail address, and they pasted 300 lines of proprietary code into the box.

Your discovery tooling looks at that session and reports an approved domain. Nothing fires. That's the whole problem in one sentence.

Shadow AI vs shadow IT: the comparison table

Dimension	Shadow IT	Shadow AI
What's unapproved	The application	Often the account, not the application
Where the risk lives	Access and data storage in a third-party app	The prompt and the file attached to it
Typical detection signal	Unknown domain, unknown OAuth grant	No unusual signal at all, traffic looks normal
Where it runs	Browser, occasionally a desktop client	Browser, ChatGPT Desktop, Claude Desktop, IDE assistants, CLI tools, scripts
Data direction	Data at rest in someone else's SaaS	Data in motion, outbound, one prompt at a time
Time to exposure	Days to weeks (accounts, sharing, sync)	Seconds (one paste)
Works against DNS filtering?	Partially, unknown domains stand out	No, the domain is already allowed
Works against CASB API connectors?	Partially, for connected apps and OAuth grants	No, an unconnected tool is invisible
Works against DSPM?	Partially, finds the data that landed	No, DSPM scans data at rest, not prompts in motion
What actually detects it	Domain and OAuth discovery	Tenant-aware TLS inspection plus prompt-level DLP
Right remediation	Sanction the app or block the domain	Force the enterprise tenant, inspect the prompt

Why shadow IT discovery solves a different problem

Shadow IT discovery grew up around three signals, and all three are about the app.

Signal 1: the unknown domain. A firewall or proxy log shows traffic to a hostname nobody recognizes. You look it up, you find a SaaS product, you make a call.

Signal 2: the OAuth grant. A user connects a third-party app to Microsoft 365 or Google Workspace. The tenant records the grant and the scopes. This is genuinely useful, and it's what AI-Powered SSPM is built on.

Signal 3: the expense report. Finance data reveals tools nobody registered.

Now test each one against a marketer who opens ChatGPT in Chrome with a personal Google account and uploads the customer churn spreadsheet.

The domain is approved, so signal 1 sees nothing wrong. There's no OAuth grant into your tenant, so signal 2 sees nothing at all. There's no expense, because the free tier costs nothing, so signal 3 sees nothing. Three signals, three misses, one spreadsheet gone.

The three things that actually changed

1. The unapproved thing moved from the app to the account

This is the structural shift. In shadow IT, the app was the unit of governance. In shadow AI, the unit of governance is the tenant.

A personal ChatGPT account and your enterprise ChatGPT workspace are different data-handling regimes with different retention terms and different administrative control, reached at the same address. Anything that identifies applications by hostname sees one thing where there are two. That's why understanding your ChatGPT workspace ID matters more than it sounds like it should.

2. The risk moved from access to content

Shadow IT risk accumulates. An app gets access, syncs a folder, keeps it. You have time to find it.

Shadow AI risk is instantaneous and content-specific. The same employee using the same tool is low risk when they ask it to rewrite an email and high risk when they paste patient records into it. You cannot score that at the application layer, because the application is identical in both cases. You have to read the content. 77% of employees have leaked sensitive data through AI tools like ChatGPT, and every one of those leaks was a prompt, not an app install.

3. The traffic left the browser

Shadow IT was mostly a browser story, which is why browser-based controls felt sufficient for years.

AI isn't. ChatGPT Desktop, Claude Desktop, Copilot inside the IDE, terminal wrappers, and internal scripts all reach models without a browser tab. Some of them pin certificates. Any control scoped to a browser extension covers a slice and reports it as the whole. The average company uses 10x more AI tools than IT approved, and the ones you're least likely to have on your list are the ones that never open a tab.

Why tenant-level visibility is the thing that changed

To distinguish a personal AI session from a corporate one, you have to see inside the encrypted request and read the tenant identifier the client sends. There's no shortcut. Roughly 95% of web traffic is encrypted, and the tenant header lives inside that encryption.

That requirement eliminates several categories immediately:

• DNS filtering resolves a name before TLS even starts. It cannot read a header that doesn't exist yet.
• Cloud proxies can inspect, but only traffic actually steered through them, and cert-pinned applications resist inspection. Zscaler documents that cert-pinned apps like M365, WebEx, and Dropbox can't be inspected on its path.
• CASB API connectors read the tenant they're connected to. The personal account is, by definition, not in your tenant.
• DSPM never touches the session.

What's left is inspection on the device, before the traffic goes anywhere.

How dope.security closes the gap

dope.security runs a Security Service Edge agent on the endpoint with an on-device SSL proxy. Traffic gets inspected on the laptop and then goes straight to its destination instead of getting backhauled to a vendor data center. Because inspection happens below the application layer, a browser tab, ChatGPT Desktop, and a CLI script all pass through the same control.

Three layers do the work:

1. AI Visibility. Discover which AI tools are in use, which sessions run on personal versus enterprise-licensed accounts, and where data is going. Coverage spans ChatGPT, Claude, Gemini, Copilot, Perplexity, and Abacus.
2. AI Controls. Cloud Application Control restricts access to approved enterprise tenants only, by inspecting decrypted TLS and reading the tenant header inside the request. It blocks personal ChatGPT, Claude, Google, and Microsoft 365 logins while allowing corporate accounts, applies enterprise-only access by tool, and syncs enforcement across the fleet in under a minute.
3. On-Device AI DLP. Dopamine DLP intercepts file uploads and AI prompts, classifies them with LLMs instead of regex, and detects PII, PCI, PHI, and IP before the data reaches a model. Zero-retention APIs, no training on customer data, no policy configuration required, US Patent no. 12,464,023.

Worth stating plainly: automatic sanctioned versus unsanctioned classification is on the dope.security roadmap and isn't shipped today. You decide which tools are approved. The product enforces that decision per tool, fleet-wide, in under a minute.

What to do with your existing shadow IT program

Don't throw it out. Shadow IT discovery still answers its original question well, and OAuth-grant visibility remains genuinely valuable for third-party app risk.

Add three things next to it:

1. An account-type field on every AI tool in your inventory. Personal or enterprise. If your tooling can't populate that column, that's your gap.
2. Prompt-level DLP in monitor mode. You need evidence of what moved, not just where people went.
3. Endpoint coverage for thick clients. Audit your own list. If it contains only websites, you're missing the desktop apps.

Conclusion

Shadow IT asked "what app is this?" Shadow AI asks "whose account is this, and what's in the prompt?" Those are different questions, and the tooling built for the first one answers the second one badly.

Tenant-aware TLS inspection on the endpoint is what closes the gap. Try dope.security free with Google or Microsoft sign-in at $60 per device per year, or book a 20-minute demo at calendly.com/dopesecurity/demo.

Frequently Asked Questions

What is the difference between shadow AI and shadow IT?

Shadow IT is an unapproved application, identifiable by an unknown domain or an OAuth grant. Shadow AI is usually an approved application accessed with an unapproved account, where the exposure is the prompt content rather than the app itself. Domain-based discovery catches the first and misses the second.

Is shadow AI just a type of shadow IT?

Partly, but treating it that way causes the miss. Unapproved AI apps behave like classic shadow IT. The larger share of shadow AI runs on tools you already allow, with personal logins, which produces no anomalous domain signal at all.

Why doesn't shadow IT discovery find shadow AI?

Because it keys on the application. A personal ChatGPT session and a corporate ChatGPT session resolve the same hostname and open the same TLS connection. Without reading the tenant header inside the decrypted request, the two look identical in any log built around domains.

What is tenant-level visibility?

Tenant-level visibility means identifying which organizational account a session belongs to, not just which service it reached. dope.security achieves it by inspecting decrypted TLS on the device and reading the tenant header inside the request, which is why DNS-layer tools cannot do it.

Does shadow AI only happen in the browser?

No, and that assumption is a common source of blind spots. ChatGPT Desktop, Claude Desktop, IDE assistants, CLI wrappers, and internal scripts all reach AI models without a browser. Browser extensions structurally cannot see any of them.

Can a CASB solve shadow AI?

A CASB governs SaaS applications you have sanctioned and connected through APIs, reporting after the fact. It has no view of a personal-account session on an unconnected tool and no view of desktop applications. See CASB vs DLP for where each one fits.

What's the fastest way to close the shadow AI gap?

Add an account-type field to your AI inventory, run prompt-level DLP in monitor mode for two weeks, then enforce enterprise-tenant-only access on your highest-volume tools. dope.security syncs that enforcement across the fleet in under a minute, so you can stage it tool by tool.

Does blocking AI tools solve shadow AI?

Rarely. Blocking a tool people depend on moves the work to a personal phone where you have no visibility at all. Forcing the enterprise tenant keeps the productivity, keeps the audit trail, and removes most of the data exposure.

Related reading

• Shadow AI detection: how to find unapproved AI use
• Shadow AI discovery: a 30-day plan
• Top 10 shadow AI detection tools in 2026
• Shadow AI tools compared: endpoint vs CASB vs browser vs DSPM
• Shadow AI detection tools for enterprises: what to look for
• Blocking personal ChatGPT accounts
• Why blocking ChatGPT doesn't work
• Shadow AI management best practices: 12 rules that work
• Shadow AI governance: building a policy people actually follow
• How to detect shadow AI without blocking everything