Shadow AI Monitoring: Which Security Services Cover It?

Shadow AI monitoring is the work of finding AI use your organization never approved and deciding what to do about it. One security service rarely covers all of it. Identity logs, SaaS audit trails, browser controls, and network inspection each see part of the activity, and each misses something another one catches.

Shadow AI often arrives through tools you already approved, accounts you do not manage, and extensions nobody reviewed. Discovery tools list that activity, and programs tend to stall at the next step, when someone has to decide whether data left and who revokes the access.

This guide maps where shadow AI shows up in your telemetry, which tools cover which gaps, and how to move from a finding to a response. Securing the AI tools you have approved is a separate problem with its own controls.

TL;DR:

• Prompts carry source code, regulated data, and credentials into models you have no contract with, which often makes the data itself the main exposure.
• Each signal source has gaps: identity logs miss personal accounts, domain-based proxy rules miss AI features inside approved SaaS, and browser controls struggle with native apps.
• Discovery tools now cover much of the same ground, so the harder question is who investigates a finding and revokes risky access.
• Revoking an OAuth grant is half the fix, because users can grant it again unless consent policy changes too.
• When findings sit unresolved for more than a week, the bottleneck is response ownership, which a managed service with identity and SaaS coverage can take on.

Why Shadow AI Raises Different Risks Than Shadow IT

Shadow AI extends familiar shadow IT risks into AI workflows. Both can expose sensitive data to unapproved services, and AI adds prompt-based disclosure, retrieval from connected repositories, and agents that can act on enterprise systems. Once someone pastes patient context into an unsanctioned LLM, the organization loses control of where that data goes and how long it persists. Pasted chat text also travels over HTTPS, so DLP rules configured only for file transfers and email can miss it.

In an October 2025 Censuswide survey of 2,003 UK employees, commissioned by Microsoft, 71% had used unapproved consumer AI tools at work, and 28% said their employer offered no approved option. Shadow AI is partly a provisioning gap as well as a security one when more than a quarter of staff have no sanctioned tool.

AI also ships inside software you already approved. Atlassian turns Rovo on automatically for Standard, Premium, and Enterprise plans, with AI features such as Rovo Chat and Agents governed by each site's AI setting. Microsoft makes Copilot Chat available at no extra cost to Microsoft Entra users with an eligible Microsoft 365 subscription. An AI feature can go live through a license upgrade or an admin toggle without a security review.

Much of that activity never reaches an inventory. In 30 days of browser telemetry, Obsidian Security recorded nearly 70,000 AI-in-SaaS events across tools including Jira's Rovo, Lucidchart, Airtable, Miro, Notion, and Slack, and none of them created a new OAuth grant or appeared in an API-sourced inventory.

OAuth grants widen the reach further. One grant to an AI tool can expose entire document repositories beyond the files an employee actively uploads, depending on its scopes and the user's access. In the 2025 Salesloft Drift breach, attackers stole OAuth tokens tied to the Drift AI chat integration and pulled data from connected Salesforce instances, and Google estimated more than 700 organizations were potentially affected.

Where Shadow AI Shows Up in Your Telemetry

Each source below gives different evidence, and its gaps decide what you can prove about access and data exposure. Read them together, since a gap in one source is often covered by another.

1. OAuth Grants and App Consent

Microsoft starts consent investigations with "Consent to application" events in the Entra audit log and checks whether an admin or an end user gave the consent. Delegated permissions such as Mail.Read and Files.Read look routine, yet attackers used a combination of the first six permissions on Microsoft's list in 99% of the consent-phishing attacks its incident response team observed.

Google Workspace's OAuth Token audit log records each authorization and revocation with the app name and scope. Most personal accounts, and local agents that never authenticate through your identity provider (IdP), leave no record in either log.

2. SaaS Audit Logs and Embedded AI

Microsoft 365 Copilot writes CopilotInteraction records to Purview Audit, including the resources it accessed and their sensitivity labels, provided auditing is enabled in the tenant. Google added Gemini audit logs to Workspace in 2024 and turned them on by default. Coverage usually ends where the vendor's API ends, and many AI tools lack the admin APIs that SaaS security posture management (SSPM) tools depend on.

3. Browser Extensions

In March 2026, Microsoft reported malicious Chromium extensions impersonating AI assistants that harvested chat content from ChatGPT and DeepSeek, with roughly 900,000 reported installs and activity across more than 20,000 enterprise tenants. Defender Vulnerability Management inventories installed extensions by device and user, with a permissions-risk rating for each. Pair that inventory with prompt-level telemetry where you have it.

4. Network, DNS, and Proxy Traffic

Network telemetry identifies destinations, and Elastic's prebuilt rule flags DNS queries to known LLM domains such as chatgpt.com and claude.ai when they come from scripting tools or unsigned binaries. Encryption is eroding that view. Cisco warns that once Encrypted Client Hello (ECH) hides the server name, functions such as URL filtering and application identification can degrade badly or stop working, and it documents mitigations for firewall teams.

Desktop apps add another gap. Version 1.2026.048 of the ChatGPT macOS app pins its TLS certificate. Pinning typically pushes teams to a steering exception, which sends that traffic around the proxy with no DLP visibility, though Netskope also documents a version-specific configuration that kept DLP working in testing. Validate current client versions before treating the app as a permanent gap.

5. Sensitive Data in Prompts

In Netskope's 2026 telemetry, sensitive-data incidents doubled in the past year as users sent data to AI apps, with the average organization seeing 223 genAI data policy violations per month. Source code made up 42% of those violations, ahead of regulated data and intellectual property. Reading typed or pasted prompts usually takes a browser control, an endpoint DLP agent, or a proxy that decrypts traffic. Exfiltration controls built for file uploads need a separate rule for that path.

How to Monitor Shadow AI: What Each Approach Sees and Misses

SaaS posture tools see grants and API activity, enterprise browsers see sessions and prompt text, and inline DLP sees traffic it can decrypt. What each one misses usually decides which second control you need.

SaaS Security Posture and Discovery

API-based SSPM is strongest on OAuth grants and weakest on activity that never touches an API. SSPM and SaaS discovery vendors such as Obsidian, Nudge, and Reco combine SaaS APIs with IdP and OAuth data, and some add email signals or a browser extension. Obsidian notes that its own agent-risk findings reflect only agents visible through sanctioned platform APIs, and Nudge compares discovery methods by what each one misses.

Browser Security

Enterprise browsers and browser extensions can see which account sits behind a session and what a user types into the prompt box. Island says it logs every AI prompt, response, and agent action. Microsoft Purview can block sensitive text sent to consumer AI apps such as ChatGPT, DeepSeek, and Gemini, and that inline inspection runs in Edge for Business on Intune-managed Windows devices. Endpoint DLP can restrict pasting sensitive content into Chrome and Firefox through the Purview extension. Network DLP covers other paths through SASE integrations, and the protection differs by route.

Native desktop and mobile apps remain the hardest gap for this category. Seraphic says it protects Electron apps such as the ChatGPT desktop client, and Island makes similar desktop claims. Test both in your own environment.

DLP and SSE

Security service edge (SSE) and DLP vendors inspect traffic inline and classify prompt content. Netskope's instance awareness separates personal from corporate tenants, though a January 2025 community post noted it did not cover all generative AI apps at the time. Confirm current support for the apps you care about. Cloudflare's most advanced DLP requires TLS decryption. A DLP hit starts an investigation that still has to reach a verdict before anyone acts on it.

The table below summarizes where each category is strongest and where its documented gaps sit.

‍

Managed detection and response providers work on top of these signals, and coverage varies. Traditional SOC coverage often thins out past the endpoint, so ask whether a provider investigates OAuth and SaaS activity at all.

From Discovery to Response

Shadow AI incidents are rising faster than most response processes. Among breached organizations IBM studied, the share reporting incidents involving unapproved AI rose from 20% to 43% in a year.

1. Triage by What the Grant Can Reach

For each finding, establish which identities and tokens it uses, what it has actually done, and whether it is still active. A dormant integration with access to a user's sensitive OneDrive files may deserve higher priority than a chatbot used only for public information. Check the exact scopes, whether access is delegated or application-level, and evidence of actual use.

2. Engage Users on Unclear Findings and Contain Confirmed Threats

For confirmed malicious apps or active data exposure, contain first and engage the user in parallel. For uncertain or low-risk findings, SANS's Rob T. Lee argues for measuring your shadow AI baseline first and approving use unless it is red-flagged. Nudge's workflow asks users to confirm whether they still use an integration and revokes the grant automatically when they say no. Set a timeout so an unanswered prompt still ends in a decision.

3. Revoke the Grant, Then Close the Re-Consent Loop

In Microsoft Entra, admins revoke admin-consented permissions from the app's Permissions page, and user-consented grants need Graph PowerShell, such as Remove-MgOauth2PermissionGrant. Revoking does not stop re-consent, so restrict user consent as a separate step. Removing a permission from an app registration also leaves existing grants in place until you revoke them.

In Google Workspace, the Directory API call DELETE /admin/directory/v1/users/{userKey}/tokens/{clientId} deletes all access tokens issued by a user for an application. Expect repeat work: across Vanta's customers, employees at the average organization reinstall revoked tools more than 100 times in 30 days. Departing users' grants need deprovisioning or transfer, or they can outlive the employee.

4. Turn Findings Into Policy

Write a rule per data class for what may go to third-party AI platforms, and review OAuth grants against it on a schedule. Some platforms connect discovery findings to enforcement workflows, and the depth of automation varies. Check whether a product only recommends a change, requires approval, or executes the policy action. Whatever the product automates, give the step a named owner and a review cadence.

Decision Criteria: Matching the Approach to Your Situation

Pick the starting point that fits where your exposure sits and how quickly your team can act:

• If OAuth sprawl across Microsoft 365 or Google Workspace is the main exposure, start with the IdP audit logs you already have and add a discovery tool that can revoke grants, since a list alone leaves the cleanup to you.
• If personal accounts on corporate devices are the main leak, you need browser telemetry or an SSE with instance awareness, because IdP logs typically cannot see those sessions.
• If embedded AI inside approved SaaS is the concern, pair API-based SSPM with a browser extension and expect little from network tools, since that traffic usually goes to domains you already allow.
• If developers run desktop AI apps and local agents, endpoint telemetry matters more than the proxy, because pinned desktop clients can sidestep inline DLP.
• If your team can find shadow AI but cannot act on findings within the week, the gap is response ownership. Evaluate a managed service with explicit identity and SaaS response responsibilities before buying another discovery tool.

Many teams match more than one of these conditions. Sequence the gaps by which one leaks data you can least afford to lose.

Shadow AI Monitoring Is Becoming an Investigation Problem

Usage signals can populate an inventory and scope an investigation, but they rarely close one on their own. Netskope makes the same point about its own market: current tools each see part of AI activity, and no single one sees every tool, instance, and usage pattern at once.

A "Consent to application" event could be a sales rep's meeting bot or a consent-phishing foothold, and the log alone rarely settles which. Telling them apart takes business context: the user's role, whether your team ever reviewed the app, what past investigations concluded about it, and whether a sensitive-data paste followed within the hour.

Who does that work depends on the operating model. Traditional MDR providers investigate alerts and take response actions within an agreed scope, though identity and SaaS findings can still come back to your team when business context is missing. AI SOC tools automate triage and investigation, and your team still owns the response.

AI-native MDR providers run agentic investigations across systems and own the verdict and response under contract, with depth that varies by provider. The test for any provider is whether it can take an ambiguous identity or SaaS alert to a verdict and execute the response, such as revoking a grant, instead of forwarding it.

Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. Its MDR investigates identity and SaaS alerts from sources such as Okta, Entra ID, and Google Workspace, and where warranted the response can include revoking sessions or blocking access. Its AI Security coverage currently centers on Claude Enterprise, using Compliance API governance events and OpenTelemetry session data, and expansion depends on other AI platforms exposing similar telemetry. Your team keeps ownership of AI use policy, and the same investigation and response model extends to broader cloud investigation across SaaS and cloud platforms.

Frequently Asked Questions About Shadow AI Monitoring

What Should Shadow AI Monitoring Report to Leadership?

Lead with exposure and response, since an app count says little about risk. Useful measures include the AI apps and integrations in use, grouped by the data they can reach, plus open findings and how long each has stayed open. Add revoked grants that came back and the signal sources that still leave gaps, such as personal accounts or native desktop apps. Tracked month over month, these show whether findings close faster than new ones arrive.

How Long Do SaaS Platforms Keep Shadow AI Audit Logs?

Often not long enough for a slow investigation. Google retains OAuth Token and Gemini log events for six months, and Copilot interaction records follow your Purview audit retention settings, which often default to 180 days. Export these logs to your own storage if investigations or audits need a longer look-back.

Is Embedded AI Like Copilot or Agentforce Shadow AI?

It depends on the definition, and the data risk looks the same either way. EchoLeak (CVE-2025-32711) allowed zero-click exfiltration from Microsoft 365 Copilot through a Microsoft Teams endpoint the content security policy allowed; Microsoft patched it and confirmed no customers were affected. In a 2025 proof of concept, Noma Security showed ForcedLeak, a CVSS 9.4 chain in Salesforce Agentforce, sending CRM data to an expired allowlisted domain bought for $5, and Salesforce shipped a fix before disclosure.

Should You Block AI Browsers?

In December 2025, Gartner advised blocking AI browsers until their risks can be managed, and said organizations with low risk tolerance may need to keep blocks in place longer. A block works best paired with an approved alternative, because blocking without one can push the activity somewhere you see less of it.

Which Compliance Obligations Apply to Shadow AI Monitoring?

It depends on the data, jurisdiction, sector, and use case, and existing rules can apply even when they never mention shadow AI. HIPAA's Security Rule requires covered entities to regularly review records of information system activity, such as audit logs, and HHS requires a written contract before an AI provider acting as a business associate handles electronic protected health information. Where an AI provider processes personal data on your behalf, GDPR Article 28 requires a binding contract or equivalent legal act, and monitoring employee prompts is itself processing that needs a proportionality check. The NIST AI RMF, published in January 2023, addresses third-party AI risk under GOVERN 6, a category of its Govern function.