Shadow AI discovery: find the AI your people already use
Shadow AI discovery is the process of finding AI tools, models and AI features that are in use at your organization without the security, legal or risk teams knowing. It works best when it combines three sources: what employees report, what your identity provider shows, and what your spreadsheets and procurement records list, with every finding triaged into one AI register that has an owner for each system.
What counts as shadow AI
Shadow AI is rarely malicious. People use tools that make them faster, and nobody told them how to request one. Four patterns cover most cases.
- Standalone chat, writing and meeting tools that staff sign up for themselves.
- AI features added to approved software by an update, often switched on by default.
- Browser extensions and plug-ins that read page content.
- Models and APIs that engineers call from code, notebooks or personal accounts.
Three sources that find it
No single source is complete. Used together they surface most of what is in use.
- Employee reports: a short, no-blame form that asks which tool, what data and what for.
- Identity provider imports: the applications people sign in to with work accounts, and the permissions they granted.
- Spreadsheets and records: procurement and renewal lists, expense reports and any inventory a team already keeps.
From finding to register
Each finding is triaged: is it an AI system, a non-AI tool or a duplicate, what data does it touch, who owns it and is it already approved. Everything that stays goes into the AI register, even when the decision is that it must stop.
Systems that continue get a governance requirements document and the two approval gates described in our AI governance framework. The register then becomes the starting list for risk assessment and for the audit package.
Why a ban does not work
A blanket ban pushes use out of sight and makes the inventory worse. A clear way to report and request a tool, with a fast answer, brings it into the open. Keep the register current, because a one-time sweep is out of date within a quarter.
How RAMP supports discovery
RAMP provides the employee report form, imports from identity-provider, CMDB and spreadsheet lists, matching and duplicate handling, a reviewer queue, and the AI register that feeds governance, risk in dollars and the audit package. Imports are file-based today; direct connectors to identity providers are on the roadmap and are not yet available.
Frequently asked questions
- What is shadow AI?
- AI that people use for work without the security, legal or risk teams knowing about it or having approved it. It includes standalone tools, AI features inside approved software, browser extensions and models called from code.
- How do you find shadow AI in a company?
- Combine employee self-reports, identity-provider application data and procurement or spreadsheet records, then triage everything into one AI register with an owner for each system.
- Is shadow AI the same as shadow IT?
- Shadow AI is a subset of shadow IT focused on AI. It has extra risks, such as confidential data entering models and unvalidated output, and it often arrives as a feature inside software you already approved.