Shadow AI is any AI tool employees use for work that IT or security never approved: the chat assistant open in a browser tab, the free summarizer bolted onto a mail client, the code helper from a marketplace. To find every AI tool in use, look where the traffic actually leaves: the browser. Network logs, expense reports and surveys each show part of the picture. A browser-level inventory shows all of it, including which account sent which text to which tool. This guide explains why shadow AI appears, how discovery is usually done, what a complete inventory looks like, and how to turn the list into a policy people can live with.
Why shadow AI exists and what is at risk
How it starts
Nobody sets out to build a shadow AI problem. It grows from small, reasonable decisions. A support agent pastes a customer email into a chat tool to get a polite reply faster. A developer asks a coding assistant to explain a stack trace that includes a connection string. An analyst drops a spreadsheet into a "chat with your data" site.
Three things make this different from older shadow IT:
- There is nothing to install. Most AI tools run in a browser tab, so there is no inventory entry and no admin prompt.
- The input is the risk. The text of the prompt itself may contain a customer record, source code or contract terms.
- New tools appear weekly. Any list of "known AI domains" is out of date the month it is written.
An AI footprint is easy to underestimate, not because people hide it, but because nobody is measuring in the right place.
What is at risk when AI use is unmanaged
The concern is rarely the AI vendor's intent. It is the loss of control over where confidential data lives once it has been sent.
- Confidential text leaves the company. Personal data, financial figures, source code, legal drafts and credentials are all routinely pasted into prompts.
- Terms of service vary. Consumer tiers may retain prompts or use them for training unless the user opts out. Without an inventory, you cannot tell which tier your people are on.
- Regulatory exposure. Personal data processed by a third party nobody has a contract with is a data-protection problem regardless of the technology.
- No evidence trail. When an auditor asks "did any of our data go to an AI tool", "we do not think so" is not an answer.
The NIST AI Risk Management Framework (https://www.nist.gov/itl/ai-risk-management-framework) is a useful reference. Its Govern function starts with knowing what AI is in use.
Five ways to discover shadow AI, and what each one misses
Most programs combine several sources. Each has a blind spot.
| Method | What it finds | What it misses |
|---|---|---|
| Proxy or firewall logs | Domains contacted from the office network | Home and mobile use, VPN split tunnels, which user and which text |
| Identity provider sign-in logs | AI apps signed into with a corporate account | Personal accounts, tools with no login, anything used anonymously |
| Expense and procurement review | Paid subscriptions | The free tier, which is where most shadow AI lives |
| Surveys and interviews | Why people use tools, which gaps the tools fill | Everything people forget or prefer not to mention |
| Browser-level inventory | Every AI site and extension actually used, per user, with the prompt content | Native desktop apps that bypass the browser |
Network logs are a reasonable first step. But they answer "which domains", not "who sent what". Do not skip surveys, since the fastest way to reduce shadow AI is to give people a sanctioned tool that does the same job.
The browser is where the signals meet. The tab is open on a managed device, the user is known, and the prompt is visible before it is sent. That is why a browser extension installed by policy is the practical way to build an AI tool inventory. For that mechanism, see force-installing a browser extension by policy in Chrome and Edge.
What a complete AI tool inventory contains
An inventory that only lists domain names will not survive its first review meeting. A useful one answers these questions:
Per tool
- Name and domain, including the web app and any browser extension.
- Status: sanctioned, blocked, or seen but not yet decided.
- Distinct users and departments in the last 30 days.
- The date it was first seen. A tool that appeared last week needs a decision; one used for a year needs a contract review.
Per use
- Who sent the prompt, from which device, at what time, to which tool.
- Whether the prompt contained confidential content, and which detector matched.
- Whether a file was attached, and which file.
- The outcome: allowed, masked, warned, justified, or blocked.
Across the estate
- Prompts containing confidential data, by department and by tool, as a trend over time.
- The list of files that have been dropped into AI chats.
AI prompts are one more way out, alongside clipboard, USB, print and uploads, and the evidence should look the same. The broader picture is covered in what is data loss prevention.
From inventory to policy: sanctioned, blocked, seen
Finding shadow AI is the first half. The second half is deciding what to do with each tool. A three-state model keeps this manageable.
Sanctioned. The tool has an owner and an acceptable-use note. Confidential content in prompts is still checked, because "approved tool" does not mean "approved to receive the customer database".
Blocked. The block should happen in the browser, before the prompt leaves, and the user should see why. A silent failure trains people to try another tool; a clear message trains them to use the sanctioned one.
Seen. Observed, not yet decided. Give this state a deadline: review the list weekly during the first months and monthly after that.
Two practical rules make the model work:
- Decide on categories, not just names. Chat assistants, code assistants, meeting transcribers and AI browser extensions each deserve one policy, then individual exceptions.
- Ship a sanctioned option before blocking a popular one. Blocking without an alternative moves the usage to a phone, where you have no visibility at all.
Controlling what goes into the prompt
Blocking tools is the blunt instrument. The more useful control is at the content level: let the question through, keep the secret out. A policy can produce three outcomes when a prompt contains confidential text:
- Mask. The sensitive span is replaced before the prompt is sent. The user asks "summarize this email from [CUSTOMER NAME]" and gets a summary that is just as useful. This is the usual default for sanctioned tools.
- Warn or justify. The prompt is paused, the user sees what was detected and either edits the text or gives a reason that is recorded.
- Block. Reserve this for the highest tiers: credentials, exact-match customer records, documents labeled at the top classification.
Detection quality decides whether people tolerate this. A detector that flags every nine-digit number as a tax ID will be disabled within a week. Detectors that recognize fingerprinted records or labeled documents keep the control switched on. For the prompt-level control step by step, see how to stop employees pasting confidential data into ChatGPT and other AI tools.
Dragging a document into an AI chat is an upload and should be checked as one: what level the file carries, what it contains, and whether that tool may receive it.
Shadow AI discovery checklist
Use this list to run a first discovery cycle and to check an existing program.
- Pull 30 days of proxy or firewall logs and extract every domain matching known AI services. Treat the result as a floor.
- Export AI-related app sign-ins from your identity provider.
- Ask finance for subscriptions with "AI", "GPT", "copilot" or "assistant" in the vendor name.
- Run a short, blame-free survey: which AI tools do you use for work, and for what task.
- Install a browser extension by policy on every managed Chrome and Edge, so discovery is continuous.
- Build the inventory with three states: sanctioned, blocked, seen. Give "seen" a review deadline.
- Decide on categories first, then exceptions.
- Define which content classes are masked, which require a justification, and which are blocked.
- Record every decision, including masked prompts, with user, tool, file and outcome.
- Confirm the extension cannot be removed by the user and is reinstalled if it goes missing.
- Report the trend, not just the snapshot: prompts with confidential data per week, by tool.
How Tracemark does it
Tracemark treats AI prompts as one more channel in the same platform that covers clipboard, USB, print, email and uploads: one agent on every endpoint, one console. AI Security is the product section for this part.
The browser extension is installed in Chrome and Edge by policy. Every prompt to an AI tool is checked in the browser before it is sent. If the text contains confidential content, the policy can mask it, so the question goes through and the secret stays, or block it. Files dropped into AI chats are checked like uploads.
The console keeps an inventory of every AI tool in use, each marked sanctioned, blocked or seen, so the weekly "seen" review is already built. The AI activity log shows who sent what, to which tool, and which file. Detection is shared with the rest of the platform: dozens of built-in detectors, custom categories by keyword and pattern, exact-data fingerprinting of records such as a customer list, document fingerprinting, and OCR of text inside images. Every decision lands in the Incidents queue as evidence, with search, saved views, CSV export and evidence packs, so "did any of our data go to an AI tool" is answered by a query rather than a guess.
Frequently asked questions
What is shadow AI?
Shadow AI is the use of AI tools for work without the knowledge or approval of IT or security: chat assistants, AI browser extensions, coding assistants and "chat with your document" sites, most on free tiers and never installed as software.
Can I find shadow AI from firewall logs alone?
Partly. Proxy and firewall logs show which AI domains were contacted from the office network, not home or mobile use, which user sent the request, or what was in the prompt. Use them as a floor and add browser-level discovery.
Should I block all AI tools?
Usually not. A blanket block moves usage to personal phones where you have no visibility. Sanction a small set of tools, mask confidential content in prompts to them, and block only the tools or content classes with the highest risk.
How do I keep the inventory current?
Make discovery continuous. A browser extension installed by policy sees a new tool the first time anyone uses it, places it in the "seen" state, and leaves you with a weekly review rather than an annual audit.
Try it
Try Tracemark free for three months. Claim it at tracemark.ca