Discovering Unauthorized AI Tool Usage Across Your Enterprise Endpoints and SaaS Stack

Shadow IT was always a cataloging problem: find the device, identify the user, add it to the inventory. Shadow AI is an exfiltration problem hiding inside a cataloging problem. The traffic looks like everything else on the wire, the tools leave no install record, and the data has usually already left the building by the time anyone notices.

AI interactions over HTTPS are structurally indistinguishable from normal web activity. SSL/TLS inspection is a prerequisite before any content-level AI-specific classification can happen, and most enterprises still do not decrypt the majority of their traffic. So the first reality is that the monitoring tools already in place cannot see what they were never configured to look for.

The second reality is that shadow AI differs from shadow IT in the direction of harm. Shadow IT creates access blind spots. A forgotten OAuth grant feeding a chain of customer invoices into an AI model is a breach waiting for discovery.

The surface area compounds the problem. It extends to OAuth grants that persist silently after initial authorization. No single tool covers all of these vectors, and the tools that cover one tend to be blind to the next.

The Cloud Security Alliance's May 2026 research quantifies the result: the vast majority of enterprise AI usage is invisible to security teams, a figure that reflects the structural gap rather than any lack of effort [1][23][12][11][13][22][45]. Generative AI is now the single largest channel for corporate-to-personal data movement. A detection strategy that treats shadow AI as a subset of shadow IT will miss most of it, most of the time.

What a layered discovery program is covering for

Five distinct channels generate their own blind spots, and an enterprise that covers only one or two leaves the majority of shadow AI invisible. Each channel requires a different detection method, and no method transfers cleanly to the others. The network and CASB layer catches known AI SaaS endpoints in managed traffic. It is blind to unmanaged and personal devices and to traffic that never hits the proxy. An employee on a personal hotspot running an AI assistant on a personal tablet produces no signal here.

The browser extension layer is the most overlooked vector. A browser extension OAuth grant creates a persistent data pipeline that bypasses CASB and network controls entirely. A marketing employee's AI writing assistant and a developer's code-completion tool each have standing access to whatever the browser can reach, and neither shows up in a standard software inventory.

The OAuth and SaaS layer reveals connected AI applications without requiring agents on endpoints. OAuth grants and SSO metadata surface tools that employees have formally authorized against corporate platforms. This layer misses copy-paste submissions through personal logins that never create a visible application connection, but it remains one of the highest-yield discovery exercises available because the grant record is server-side and difficult for an employee to remove. The endpoint and local model layer addresses employees who run open-source models such as Llama and Mistral directly on corporate machines. These installations bypass every network and SaaS control, and EDR and endpoint agents must be explicitly extended to detect them because default profiles are not tuned for AI runtimes. If you build shadow AI discovery infrastructure, you are constructing the foundation a governed AI platform requires. Speakeasy, an enterprise AI control plane, is that central governed layer, and it connects all five detection channels into one enforcement and observability point, so discovering shadow AI becomes the first step toward governing it.

Network traffic and CASB inspection as the first detection layer

Network-level inspection is the fastest path to baseline visibility because it builds on infrastructure most enterprises already operate. But it requires SSL/TLS decryption to be meaningful, and it will always have coverage gaps on unmanaged devices. The starting point is log and classify, not block. Outbound DNS queries and HTTPS connections to known AI API domains should be cataloged: api.openai.com, api.anthropic.com, generativelanguage.googleapis.com, api.together.ai, and their equivalents. CASB and SSE inline proxies from vendors such as Netskope and Zscaler match live traffic against a catalog of generative AI applications and can enforce block or allow policies inline, but the immediate value is awareness of what is already flowing.

The catalog problem deserves attention because it defeats static blocklists. The Cloud Security Alliance's May 2026 research notes that Netskope tracked more than 1,550 distinct generative AI SaaS applications by mid-2025, up from roughly 317 at the start of that year [1][23][12][11][13][22][45]. Any blocklist assembled today is materially stale within weeks. The correct posture is a continuously updated catalog backed by policy that defaults to visibility.

If traffic from employee devices spikes during work hours, especially to AI API endpoints, that is a reliable early signal, so configure SIEM alerts around it. A marketing coordinator whose machine suddenly generates sustained traffic to an AI image-generation endpoint is not necessarily a policy violation, but the pattern warrants review. Feed firewall and proxy logs into the SIEM so that AI-related traffic events correlate with user identity and device context rather than raw IP addresses.

The hard limit is honest: CASB is blind to unmanaged devices. Employees who switch to personal hotspots or use personal laptops produce no signal at the network layer, and no amount of tuning changes that. This gap is precisely what the subsequent layers address.

Browser extension audits and real-time prompt monitoring

Browser extensions represent the shadow AI channel most likely to be active and undetected in any enterprise today. The discovery step is straightforward and does not require new tooling. Browser extension inventories from endpoint management or browser management platforms such as Chrome Enterprise and Edge management show which extensions are installed, what permissions they request, and which employees have them. An inventory that has never been pulled will almost always produce surprises on the first run.

The audit criterion is specific. Extensions requesting access to read and change all data on websites you visit, paired with AI-vendor domains in their network activity, are high-priority candidates for review. A source-code leak of that scale is the extreme outcome. The everyday outcome is quieter, and it accumulates.

Audits are point-in-time, and that is their limitation. Tools that deploy a browser agent can detect and block sensitive data being pasted or uploaded into AI prompts as it happens, covering ChatGPT, Claude, Copilot, Gemini, and others. The combination of periodic audits for the install base and continuous monitoring for the data flow is what turns a catalog into a control.

OAuth grant discovery and SaaS integration mapping

The OAuth grant inventory is often the single most revealing discovery exercise an enterprise can run. It surfaces AI applications with persistent, scoped access to corporate data that have never appeared in a software catalog or network log, and it does so without deploying a single agent. The mechanics are simple. An employee connects an AI tool to a corporate Google Workspace, Microsoft 365, Slack, or Salesforce account using personal or corporate credentials, and the grant persists indefinitely. The connection is simply there.

Discovery starts at each major SaaS platform's admin console: Google Workspace Admin, Microsoft Entra ID, Slack admin. The OAuth grant list is pulled and filtered for applications with AI-related names, publishers, or permission scopes, then sorted by grant date and scope breadth. Jivrus Technologies, Happytalk, and Stability AI showed up in active enterprise use with failing security grades because they lacked basic controls such as encryption and multi-factor authentication, per Reco AI's identification cited in the Cloud Security Alliance's May 2026 research [1][23][12][11][13][22][45].

Risk-tiering the grant list converts raw output into an actionable queue. Applications that fail the security posture check or have no business justification are candidates for immediate grant revocation. Applications employees are actively relying on become the starting point for a conversation about sanctioning the tool with controls or providing an approved alternative.

AI notetaking bots and meeting transcription services are the frequently missed subcategory. They connect via calendar OAuth, join calls automatically, and ingest spoken confidential content, but they never appear in any network or endpoint log. Few employees think of a meeting recorder as an AI tool, and few IT inventories list it as one.

Endpoint scanning for locally installed AI applications

Local AI model runners are the detection gap that network and SaaS controls are structurally blind to, and their prevalence grows as open-source models become easier to run on standard corporate hardware. What to scan for is specific: local LLM runtimes such as Ollama and LM Studio, one a command-line tool and one a desktop application; open-source model files in the form of large.gguf or.bin files in user directories; and AI-native coding tools configured to call local endpoints rather than cloud APIs. EDR platforms and MDM solutions can query installed application lists, running processes, and large file presence across the managed fleet, but only if you configure that policy explicitly. Most EDR default profiles are not tuned for AI application detection, so enterprises with EDR deployed still miss this entire category.

The reason to care is that a developer running Llama or Mistral locally produces no outbound AI traffic, creates no OAuth grant, installs no browser extension, and generates no CASB alert. Corporate data fed to that local model may still be synced to personal cloud storage, committed to a repository, or accessed by other processes on the same machine. The endpoint layer also catches AI-native coding environments like Cursor when configured with personal API keys. The traffic may go to an external API, but through a personal account that bypasses any corporate network policy.

The practical starting point is modest. Add AI runtime application names and model file extensions to the EDR's software inventory query or MDM compliance policy, and flag devices where these are present for manual review. This layer requires managed device coverage. Unmanaged personal devices are out of scope for endpoint scanning, which is a coverage boundary, not a failure of the approach.

Behavioral and identity signals that surface what technical scans miss

Technical scanning surfaces the tools. Behavioral and identity signals surface the usage patterns. The two together are necessary because a meaningful share of shadow AI leaves no technical artifact at all on enterprise infrastructure.

You already have identity-correlated signals in the logs the identity provider produces. Users who authenticate to the corporate IdP from unusual endpoints or at unusual hours, and users who bypass SSO to access SaaS platforms directly, may be routing work through personal accounts to avoid the corporate discovery layer. These are indicators, not proof. They trigger investigation, not immediate action.

UEBA and anomaly signals add a second dimension. If a writer suddenly produces ten times the normal document throughput, an AI tool is likely doing the drafting. Bulk data exports preceding a new AI tool authorization event should raise a flag, because the sequence often means a user is pulling down a corpus to feed into an unsanctioned model.

Expense and procurement signals are the quietest channel and often the most direct. AI subscriptions expensed through corporate cards or reimbursement systems are a reliable discovery channel. Cross-reference finance and AP data against the approved tool list, and you surface tools that IT never touched, with a dollar amount, a vendor name, and a named employee attached to each record.

The value of this layer is that it catches what the technical scans cannot. The goal is to route investigative effort toward the signals most likely to produce a real finding. Speakeasy surfaces unauthorized AI activity across all these vectors in one place, so security teams get the real-time observability that traditional endpoint and network tools cannot provide alone.

The CB Financial and EU AI Act enforcement context: why detection timelines now carry legal weight

Two dated developments in 2026 changed the cost calculation for slow detection. Failing to find shadow AI within a reasonable timeframe is no longer just a security failure. It is a documentable legal exposure, and the penalties are now specific enough to appear on a risk register.

On May 7, 2026, CB Financial Services filed what appears to be the first SEC Form 8-K triggered by unauthorized employee AI use rather than a cyberattack [1][23][12][11][13][22][45]. The filing suggests that data sensitivity alone may be sufficient to trigger materiality disclosure, independent of operational disruption. The regulatory signal is that a material AI exposure does not require a breach to require a filing.

A major regulator added the second development. The EU AI Act activated Article 50 transparency obligations and GPAI enforcement powers on August 2, 2026, and the Digital Omnibus, Regulation (EU) 2026/1744, entered into force July 27, 2026, deferring high-risk obligations under Annex III until enforcement begins on December 2, 2027. The Cloud Security Alliance's May 2026 research states the consequence plainly: an incomplete AI system inventory becomes a legal violation carrying penalties up to €15 million or 3% of global annual turnover, and discovery programs that produce an auditable inventory are a direct compliance input [1][23][12][11][13][22][45].

Both developments share a single requirement: organizations must know what AI is in use, because you cannot disclose what you have not discovered, and you cannot inventory a system you have not detected. The 403-day median detection window from Reco AI's 2025 report means that for most organizations the legal exposure window is already open by the time detection begins. Only continuous monitoring can keep the inventory current enough to be a defensible compliance artifact.

Moving from point-in-time audits to continuous AI visibility

A one-time audit produces a snapshot that begins aging immediately. The generative AI application landscape grew nearly fivefold in under a year, per the Cloud Security Alliance's May 2026 research citing Netskope data, so any inventory taken at a point in time is materially incomplete within weeks [1][23][12][11][13][22][45]. The fix is not a better audit. It is operationalizing each detection layer so that new shadow AI tools surface within days rather than months.

Operationalizing the network layer means configuring CASB policies to alert, not just log, on first-seen generative AI domain contacts, with alerts fed to the SIEM with user-identity context so triage is immediate. Operationalizing the endpoint layer means adding AI runtime detection to MDM compliance policies so that a new Ollama or LM Studio installation triggers a compliance flag within the next device check-in cycle. Operationalizing behavioral signals means building SIEM correlation rules for the indicators already identified: expense data, IdP anomalies, output volume spikes. Human investigation then gets triggered by the system, not by accident.

Discovery without a defined response is incomplete. Continuous visibility should feed a tiered governance process: approved tools that are fully sanctioned, limited-use tools with guardrails applied, and prohibited tools that are blocked or revoked, per the framework described in Adaptive Security's June 2026 analysis. Provisioning sanctioned AI tools also reduces unauthorized use substantially, per the Cloud Security Alliance's May 2026 research, and continuous discovery programs should track that ratio over time as a measure of governance effectiveness rather than a compliance checkbox [1][23][12][11][13][22][45].

The infrastructure layer that makes continuous visibility operationally sustainable at enterprise scale is an AI control plane that governs the connection points between employees, AI tools, and enterprise systems, enforcing RBAC through existing identity providers, surfacing audit logs, and detecting shadow AI in real time. Speakeasy operates in this category, and if you are evaluating how to sustain this program beyond manual processes, consider whether a purpose-built governance layer belongs in your stack. Discovery is the prerequisite for everything else: governance, compliance, and responsible AI scaling all depend on knowing what is running.