Shadow AI: what it is and how to detect it

Every company has two AI adoption rates: the official one, and the real one.

Shadow AI is the gap between them: AI tools in daily use without IT’s knowledge or approval (personal chatbot accounts, browser extensions, API keys on private cards). In PagerDuty’s June 2026 survey of 1,250 office professionals at large enterprises, two-thirds said they had used AI tools at work even though they believed company policy didn’t allow it. That is not an edge case. That is what an organization looks like before it ships an approved alternative.

What is shadow AI?

Shadow AI is the use of AI tools inside an organization without the knowledge, approval, or oversight of IT and security. The term covers personal ChatGPT, Claude, and Gemini accounts used for work tasks, AI features switched on inside otherwise-approved software, browser extensions that read the page, and API keys wired into scripts outside any procurement process.

What defines it is the data flow rather than the tool: every prompt can carry source code, customer records, or credentials into a system nobody vetted, one conversation at a time.

Almost none of it is malicious. People are finishing their work with the best tool they can reach, and when the official option is missing or worse, the personal one wins. A detection effort that starts from blame will mostly teach people to hide better.

How is shadow AI different from shadow IT?

Shadow IT was mostly an app problem — an unapproved SaaS subscription, a rogue file share. The app was the risk, and blocking or approving the app largely contained it. Shadow AI renews the risk with every prompt. A single browser tab can carry a quarter’s worth of customer records out of the company in an afternoon, spread across messages that look, individually, like nothing at all.

What shadow AI looks like in practice

• Personal chatbot accounts. Consumer tiers, where conversations may be used for model training depending on settings the employee never opened.
• AI inside approved software. The CRM or notes app passed security review; the AI assistant added three releases later was never re-reviewed.
• Browser extensions. Summarizers and writing aids that read every page, including the internal admin panel.
• Personal API keys. A developer pays $20, wires a key into a script, and expenses nothing. The provider now sees production data; the company has no record it happens.
• Coding assistants and agents. IDE plugins and CLI agents pointed at the repository — high volume, high sensitivity, and usually invisible to anyone but the developer. One of them, Claude Code, arrives through personal accounts so routinely that we gave it its own guide.

What does shadow AI cost when it goes wrong?

The honest version of the risk section is short and quantified. IBM’s 2025 Cost of a Data Breach report found shadow AI in one in five breaches studied, at an average premium of $670K over the ordinary incident; among organizations breached through AI, 97% lacked AI access controls. The 2026 edition, released a few weeks ago, says the trend line matters more than any single number: shadow-AI incidents more than doubled year over year, and breaches involving AI now cost about $1M above the global average.

Two properties make the losses hard to walk back. Pasted data can’t be recalled: whatever left is now subject to the provider’s retention policy, not yours. And there is no audit trail — for a regulated company, being unable to state what left the network is itself a finding, separate from the leak.

Does blocking fix it?

Nine in ten organizations block at least one GenAI app, per Netskope’s 2026 Cloud and Threat Report. The same report counts an average of 223 GenAI-related data-policy violations per organization per month, more than double the prior year. Both numbers are true at once: when the corporate network says no, the work continues from a personal phone or a home laptop, outside anyone’s field of view.

Blocking changes where shadow AI happens,
not whether it happens.

Blocking has a place. A curated blocklist of clearly unsafe apps beats nothing, and most organizations maintain one. As the only strategy, it optimizes for invisibility.

How to detect shadow AI: six signals

None of these require a new budget line; a first shadow AI discovery pass is roughly an afternoon per signal, with tools already in place.

1. Web proxy and DNS logs. Match outbound traffic against a list of GenAI domains — the major chatbots, their API hosts, the long tail of wrapper apps. The fastest first read on scale. Expect a bigger number than anyone guessed.
2. OAuth grants in the identity provider. Third-party AI apps that employees authorized against corporate Google or Microsoft accounts, often with mail or drive scopes. Five minutes in the admin console, routinely skipped.
3. Browser extension inventory. Via MDM or the browser’s enterprise reporting, extension IDs checked against known AI summarizers and writing aids.
4. Expense and card data. $20-a-month line items from AI vendors are shadow AI with a paper trail — and the easiest population to migrate, since they have already demonstrated demand. On a governed platform, each of those subscriptions becomes a virtual key: the same usage, now attributable by name rather than by an outbound domain in a proxy log.
5. Endpoint DLP. Paste and upload events into known GenAI apps. This is where violation counts like Netskope’s come from. It is also the noisiest signal, so tune it before alerting anyone.
6. Ask. An anonymous survey with explicit amnesty. The goal is a map of demand, not a case file; teams that fear punishment will answer no.

Security vendors also sell dedicated shadow AI discovery tools, usually as part of a CASB or SSPM product. They automate the network-, SaaS-, and OAuth-level signals and maintain the GenAI app catalog for you; they don’t change what the signals can see. If you already run one, start there instead of building the domain list by hand.

What detection can’t do: see personal devices, read traffic it doesn’t proxy, or notice the AI feature that shipped inside an already-approved app last month. A detection pass is a snapshot, not a control. Its real product is the list of use cases your organization has already voted for.

Detection gives you a map. Then what?

The durable fix is the same one that worked for shadow IT: make the approved path at least as good as the personal one, and make it visible. For AI, that means an approved place to chat with strong models across providers, governed API access for the scripts and agents people have already built, and enough observability to answer who used what, at what cost.

That is the shape SecondStack takes — a self-hosted platform where the chat app and the LLM gateway share one governance layer: virtual keys per user and app, budgets with hard cutoffs, SecondGuard screening prompts for PII and secrets, usage analytics in ControlTower, and chat history in your own PostgreSQL rather than a vendor’s cloud. The tools people were reaching for anyway, on infrastructure you control; why we built it that way is its own story.

If your first detection pass turned up more than you expected, write to hello@secondstack.ai — we’ll walk through what an approved alternative has to cover before people adopt it voluntarily.