Use Case: AI Security
Shadow AI discovery
47 employees were using personal ChatGPT accounts on corporate devices to process customer support tickets. None of those accounts had enterprise data handling agreements. ManySignal found the pattern in the first week.
The AI tools your employees are using right now
A 2024 Salesforce survey found that 55% of employees are using AI tools at work without employer knowledge or approval. These tools range from benign productivity enhancements (Grammarly) to significant data sharing risks (pasting customer data into consumer ChatGPT). The challenge for security teams is that AI tool usage looks like normal HTTPS traffic — without category-aware monitoring, it's invisible.
Shadow AI discovery serves two purposes: understanding the organization's actual AI risk posture, and providing the data needed to create an AI acceptable use policy that reflects how employees actually want to work rather than restricting all AI access.
detection: shadow_ai_discovery
type: network_classification + oauth_audit
sources:
- web_proxy_logs (bluecoat, zscaler, netskope)
- dns_query_log
- microsoft_365_oauth_consents
- google_workspace_app_access
process:
- classify: traffic.destination AGAINST ai_service_database (500+ services)
- categorize: approved vs unapproved vs unknown
- correlate: user, volume, data_sensitivity_of_session
- report: shadow_ai_inventory by tool, user_count, data_risk_score
output:
- weekly_shadow_ai_report: new_tools_discovered, risk_assessment
- policy_recommendations: approve, block, or review
- data_handling_assessment: gdpr_compliance, training_data_opt_outMITRE coverage
Shadow AI FAQ
What is shadow AI and why does security care about it?
Shadow AI is the use of AI tools and services by employees without security or IT approval — analogous to shadow IT but for AI. Security cares because: unapproved AI tools may have weaker data handling agreements, employees may share sensitive data with tools that train on user inputs, and unapproved AI agents may have broad system access that isn't reviewed in security assessments.
What AI tools are commonly found as shadow AI?
Consumer ChatGPT (vs corporate ChatGPT Enterprise), personal GitHub Copilot subscriptions (vs approved team licenses), Gemini personal accounts, character.ai, Perplexity, Grammarly AI, Otter.ai, Notion AI, and a growing number of AI coding assistants (Cursor, Windsurf) that may not be on the approved list.
How does ManySignal discover shadow AI without monitoring personal devices?
Shadow AI discovery focuses on corporate network traffic and corporate devices. ManySignal classifies AI-related API destinations in proxy and DNS logs, identifies OAuth app connections to AI providers in M365 and Google Workspace consent logs, and monitors for AI tool API keys appearing in corporate code repositories or CI/CD pipelines.
Can ManySignal block shadow AI tools rather than just discover them?
Yes, via proxy category blocking or Zscaler/Netskope policy. ManySignal maintains a category database of known AI services that can be integrated with most enterprise web proxies. The recommended approach is a tiered policy: block high-risk AI tools, require approval for others, and auto-approve tools that meet data handling requirements.
Discover every AI tool your organization is actually using
Network classification, OAuth audit, and data risk assessment — for an accurate shadow AI inventory.