# Shadow AI

> Discovering unsanctioned tools, and understanding why people reached for them in the first place.

Source: https://brocs.fyi/secure/shadow-ai/
Part of the surface: S · Secure. Prove it is not going off the rails.
Framework: BROCS (Build, Run, Observe, Control, Secure), brocs.fyi. CC BY 4.0, attribute to brocs.fyi.

---

## The Secure surface

- Governance: policy encoded where it is enforced, not a PDF
- Agents: tool permissions, audit trails, human in the loop
- Shadow AI: discovery of what people use when you give them nothing
- Cost: who spends what, on which model, showback and chargeback
- Compliance: HIPAA, SOC 2, PCI, FedRAMP, EU AI Act as platform output


Shadow AI is the use of AI tools your organization has not sanctioned, usually through
personal accounts and personal payment methods. It is normally framed as a discipline
problem. It is better understood as a routing problem: demand exists, the sanctioned path
is missing or slow, so the demand finds another path.

## The numbers, with sources

Cisco's 2024 Data Privacy Benchmark Study, a double-blind survey of 2,600 privacy and
security professionals across 12 geographies, reported that **48 percent of organizations
admitted entering non-public company information into generative AI tools**, and that
**27 percent had banned the tools at least temporarily** over privacy and security
concerns. The same study found 63 percent had established limits on what data can be
entered and 61 percent had limits on which tools can be used.

Read those together and the picture is clear enough. Roughly half of organizations know
non-public information has gone into these tools, a quarter responded with a ban, and
most of the rest responded with a rule. Neither response addresses why it happened.

A ban is worth being precise about: it moves the activity rather than stopping it. The
work still needs doing, the tool is still one browser tab away, and the only thing that
reliably changes is that people stop telling you.

Source: [Cisco 2024 Data Privacy Benchmark Study](https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-privacy-benchmark-study-2024.pdf)
and the [accompanying release](https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m01/organizations-ban-use-of-generative-ai-over-data-privacy-security-cisco-study.html).

## Discovery, in rough order of effort

**Expense reports.** The highest-yield and least technical source. Personal-card
reimbursements for AI subscriptions tell you exactly which tools, which teams, and how
long it has been going on. Start here.

**SSO and OAuth grants.** Any tool someone authorised against a corporate identity is
visible in your identity provider's application list, including ones nobody approved.
Review it; the list is usually longer than expected.

**Network and DNS telemetry.** Traffic to known AI provider domains from corporate
devices. Blunt and only covers managed devices on managed networks, but it establishes
scale.

**Browser extension inventory.** Frequently the least governed software in the estate,
often with permission to read every page the user opens.

**Asking.** An amnesty produces better data than any of the above, and only works once, so
spend it well. Make it explicitly non-punitive, ask what they were trying to do, and
publish what you build in response.

## The response that works

Discovery is the easy half. What you do next determines whether it recurs.

1. **Find out what they were trying to do.** Every shadow tool is a task the sanctioned
   path did not cover. That list is your roadmap.
2. **Ship a sanctioned path for the common cases**, quickly, even if it is worse than the
   tool they found. It has to be close enough that the difference is not worth the risk.
3. **Migrate the accounts** rather than deleting them, and take the data with you. Deleting
   an account someone depends on without a replacement teaches them to hide the next one.
4. **Then close the unsanctioned path**, once the alternative is real.

Reversing steps two and four is the common mistake, and it is why the second wave of
shadow AI is always harder to find than the first.

## Personal accounts are the durable risk

A tool bought on a corporate card is at least an asset. A tool on a personal account is
not: your organization's data sits in an account you do not control, held by a person who
may leave, under terms nobody read, with a password you cannot rotate and no way to
export.

When that person leaves, the data leaves with them, and there is no offboarding step that
touches it. That is the risk worth prioritising, ahead of the tool choice itself.

{{< aside title="How shadow IT thinks about this" >}}
The shadow IT literature settled this argument years ago: shadow adoption is a signal
about unmet demand, and organizations that treated it purely as a compliance failure got
the same outcome repeatedly. What changed with AI is speed and surface area. The tools are
free, need no installation, and the data goes in as text rather than as a file, so none of
the controls built around file movement see it.
{{< /aside >}}

{{< checklist >}}
- Pull the last six months of expense reports for AI tool subscriptions. What is on the
  list?
- Which third-party applications have OAuth grants against your identity provider?
- What does someone in your organization do today when they need an AI capability you do
  not provide?
- If a person who set up a personal AI account left tomorrow, what would happen to the data
  in it?
- Could you tell whether someone in accounting is using the company assistant for
  personal work? If not, you also cannot tell what anything costs or who caused a spike;
  the attribution gap is the same gap.
- Have you asked, without consequences attached?
- For each shadow tool you find, what is the sanctioned equivalent, and how long until it
  exists?
{{< /checklist >}}