# How to find shadow AI in your company

> A seven-step inventory of the AI services your company really uses: contracts, admin consoles, OAuth grants, DNS and network traffic, devices and people.

Source page: https://netsenx.com/en/blog/2026-11-12_find-shadow-ai-in-your-company · NetSenX Team · 2026-11-12

To find shadow AI, combine what the company already knows about its AI services (contracts, card statements, admin consoles) with what its identity provider and its network show, then ask the teams. No single source is complete: the network does not see personal phones on mobile data, the identity provider does not see a personal chatbot account, and nobody remembers every browser extension. Together they give an inventory you can defend. The steps below take a small IT team a few days the first time and much less every quarter after that.

## 1. Start with what you pay for

List the AI services on contracts, invoices and expense reports, including the AI add-ons of software you already license (office suites, CRM, helpdesk, design and developer tools). Note who owns each one and whether a data-processing agreement is in place. This is the "approved" column of your inventory; everything you find later is measured against it.

## 2. Read the admin consoles

Most business software now ships AI features that an administrator can switch on or off. Check the admin console of each major system for AI settings, and write down what is enabled, for whom, and whether customer data can reach the feature. Many shadow AI findings are not new tools at all, but features switched on by default in an update.

## 3. Check the identity provider for AI grants

Look in your identity provider and SaaS admin consoles for OAuth applications and API tokens linked to AI tools: assistants connected to mailboxes, drives, calendars or repositories. Pay attention to broad scopes ("read all mail", "access all files") and to grants made by individual users rather than by an administrator. These are the access paths that survive an employee's departure if nobody revokes them.

## 4. Look at DNS and proxy logs

If you run your own DNS resolver or a web proxy, its logs show which AI service names devices look up or reach. It is a quick first pass, with two limits: it says nothing about volume, and devices that use their own encrypted DNS bypass it.

## 5. Add the network view

A network sensor on a mirrored switch port sees every device on the segment, including printers, servers and laptops that no agent covers. From the server name in each TLS handshake and the destination address it identifies the AI service, and it measures how much data each host sends to it. That is the step that turns a list of names into a ranking: which machines send real volumes to which services, and which local model servers others connect to. It does not read the content, and it only sees the networks you monitor.

## 6. Check developer machines and servers

Developers adopt AI first and fastest. Ask for, or scan for, coding assistants, local model runtimes, agent frameworks and MCP server configurations on build servers and workstations. A local MCP server talks to the assistant on the same machine and never appears on the network, so this step is the only way to find it.

## 7. Ask the teams, without blame

Send a short survey or hold a fifteen-minute conversation per department: which AI tools do you use, for what, and with which data? People answer honestly when the purpose is to give them an approved tool rather than to punish them. Their answers explain what the logs show, and often reveal tools used only on personal devices.

## Turn the findings into decisions

Give every service a status: approved, tolerated for non-sensitive data, or to be replaced by an approved alternative. Record which data classes may go to each one. Then repeat the network and identity checks every quarter, because new AI features keep arriving with ordinary updates. The policy side, including the AI Act literacy duty and the GDPR questions, is covered in the [shadow AI guide](/en/blog/2026-11-12_shadow-ai-guide).

## Where NetSenX fits

Step 5 is what NetSenX does. From the Pro plan it flags traffic to external AI services and to locally run language-model runtimes, and shows which host reached which service, when and how much data moved, without decrypting anything. It does not block services and does not read prompts. See the [shadow AI detection page](/en/shadow-ai-detection) for what it covers on each plan.

## Sources

- [RFC 6066, TLS extensions: Server Name Indication — IETF](https://www.rfc-editor.org/rfc/rfc6066)
- [RFC 6749, The OAuth 2.0 Authorization Framework — IETF](https://www.rfc-editor.org/rfc/rfc6749)

---

*Written by the NetSenX Team at TriStiX S.L. Questions: [info@netsenx.com](mailto:info@netsenx.com).*