Shadow AI: Finding the AI Tools Your Staff Already Use

Say you run an engineering firm outside Round Rock. Your project managers have quietly started feeding client specs into a free AI summarizer to save time on status reports. Nobody flagged it because nobody asked — the tool is free, browser-based, and doesn't show up on any software inventory your team manages. That's shadow AI, and it's a different animal than shadow IT. The old shadow IT problem was mostly about licensing and support headaches. Shadow AI is about where your data goes once an employee pastes it into a prompt box you don't control.

Texas has started paying attention to this gap too, with AI governance expectations taking shape at the state level. If your business handles protected health information, HIPAA obligations may also apply, and if you touch financial data, the FTC Safeguards Rule may apply as well. None of those frameworks care whether the exposure happened through an approved system or a free Chrome extension someone installed in March. The liability lands the same place either way.

Don't start with a company-wide survey — people under-report tool use even when they're not trying to hide anything. They just forget. Instead, pull from systems that already know the truth.

Run all four and cross-reference. You'll usually find overlap — the same tool shows up in the expense report and the Entra consent log — which tells you it's established enough to be worth a real conversation rather than a one-off warning.

Here's where a lot of IT teams go wrong: they find the list and immediately send a lockdown email. That approach backfires. Employees who found a tool that genuinely helps them will just find a quieter way to keep using it, and now you've lost visibility instead of gaining it.

A better move is triage. Sit down with whoever's using each tool and ask three questions: What problem does this solve for you? What data goes into it? Would a sanctioned alternative work just as well? Some tools get an easy yes once you've confirmed the vendor's data handling terms. Others get replaced with something already inside your Microsoft 365 environment, where you already control the data boundary. A small number get shut off entirely — usually the ones pulling client data into a consumer-grade tool with no enterprise agreement at all.

An AI acceptable use policy only works if it's specific enough to answer real questions — which tools are pre-approved, what data categories are off-limits for any AI input, and who to ask when a new tool comes up. Vague "use AI responsibly" language doesn't survive contact with a busy employee trying to hit a deadline.

This is also where access controls matter. Pairing your AI policy with privileged access management means you're not just writing rules — you're limiting which accounts can grant new app permissions in the first place, so shadow AI has a harder time getting a foothold next quarter. If your organization is ready to formalize ongoing oversight of AI tool adoption, data flows, and policy enforcement, that's a conversation worth having with a team that treats bringing AI tool sprawl under control as an ongoing program rather than a one-time cleanup.

Shadow AI discovery isn't a standalone project — it's one more input into the risk picture your cybersecurity program should already be tracking. If you're handling this as part of a broader managed IT services relationship, the discovery scans and policy work can run alongside patching, backup, and endpoint management instead of becoming yet another standalone initiative competing for attention.

How do I find out which AI tools employees are using at work?

Pull Entra ID enterprise application consent logs, run a Defender for Cloud Apps discovery scan, audit browser extensions on managed endpoints, and cross-check corporate card expense reports for AI subscriptions. Cross-referencing these four sources gives you a far more accurate picture than asking employees directly.

Is shadow AI the same thing as shadow IT?

They're related but not identical. Shadow IT is any unapproved software or hardware. Shadow AI specifically involves tools that process input data through a model — meaning the risk isn't just an unmanaged app, it's unmanaged data exposure, since prompts and uploads often leave your control entirely.

Should we just block all unapproved AI tools?

Blocking everything without a conversation usually pushes usage further underground. A triage approach — understanding why employees adopted a tool, then approving, replacing, or restricting it based on actual data risk — tends to hold up better over time than a blanket ban.

Does Texas have specific AI rules businesses need to follow?

Texas has been developing AI governance expectations at the state level, and depending on your industry you may also fall under existing frameworks like HIPAA or the FTC Safeguards Rule, which can govern how data is handled regardless of whether AI is involved.

If you're not sure what's already running inside your environment — AI tools included — a free IT assessment is a practical place to start. Or if you'd rather just talk through what discovery might turn up for your specific setup, contact our Texas-based team and we'll walk you through it.