The signals
How do you detect shadow AI before the data leaves?
It takes five sources, never one: DNS and proxy logs, CASB events, DLP paste events, endpoint inventory and expense data. To govern risk you must first see it, and shadow AI discovery starts by correlating those signals:
Network and DNS logs
Most shadow AI traffic routes through known domains (chat.openai.com, claude.ai, gemini.google.com) or niche vertical tools. A Secure Web Gateway or DNS filtering layer set to log traffic, rather than blindly block it, identifies usage volumes, frequency, and the specific business units driving it.
CASB and proxy telemetry
Cloud Access Security Brokers detect SaaS sign-ups that bypass corporate SSO: a personal Gmail address used for an AI assistant, or spreadsheets uploaded to an unauthorized summarizer. This applies proven Shadow IT discovery methods to a new risk category.
DLP paste and upload events
The most critical signal for breach prevention. Data Loss Prevention rules calibrated to detect large text blocks, source-code patterns, or customer PII (regex) intercept data exposure at the exact moment it occurs.
Endpoint application monitoring
A significant portion of shadow AI bypasses network controls entirely via local applications (Claude Desktop, ChatGPT Desktop) or IDE extensions (Cursor, GitHub Copilot) communicating over standard TLS ports. Endpoint agents that inventory installed applications are required to clear this blind spot.
Finance and procurement data
One of the simplest and most reliable sources: expense reports and corporate card statements. A $20/month recurring charge to “OpenAI” or “Anthropic” on a manager's card, without procurement approval, is indisputable proof of usage.
Anonymized internal surveys
Asking teams directly works, provided you guarantee zero retaliation. The Menlo Security data (68% usage, 57% leaks) comes from anonymous surveys where employees could speak frankly.
No single signal provides the full picture. Correlating these data points, network logs with DLP, or endpoint inventory with expense data, is what builds an actionable shadow AI map. The AI Security pillar covers the architecture behind it, and Zero Trust remote access is the enforcement layer this map rides on. Assess your own infrastructure exposure first: a large share of shadow AI risk stems from incomplete Cloudflare configurations, missing WAF rules, unfiltered DNS, overly permissive Zero Trust policies. Metryx, Brixio's free audit tool, scores the zone side in minutes: DNS, TLS, WAF, rules, bots.
The tooling
Which shadow AI detection tools cover which blind spot?
Each layer sees one thing and misses another: DNS and CASB see the browser, DLP the paste, an endpoint agent local apps, an AI gateway only the sanctioned path. The gaps between them are where shadow AI survives. What to expect from each layer, before buying anything:
01
DNS filtering and secure web gateway
Sees every browser session to a known AI domain, with volume, frequency and business unit. Misses local desktop applications, self-hosted models, and any tool whose domain is not categorised yet.
02
CASB
Sees SaaS sign-ups that bypass corporate SSO, including personal-account access to otherwise sanctioned platforms. Misses anything that never touches an OAuth flow, and free tiers that require no account at all.
03
AI DLP
Sees the paste or upload itself, scored against source-code patterns, customer PII and large text blocks. Misses data typed by hand, screenshots, and content routed through a personal device.
04
Endpoint agent and SaaS management
Sees installed applications, IDE extensions and local LLM runtimes. Misses unmanaged and third-party hardware, where no agent can be deployed at all.
05
AI gateway or reverse proxy
Sees every prompt and response transiting the sanctioned path, with per-team cost and usage. Misses, by design, everything that deliberately avoids that path, which is why it belongs after detection rather than instead of it.
Two things follow. Shadow AI monitoring is a correlation exercise, not a product purchase: the value sits in joining these layers, not in picking the best one. And the tooling you already own usually covers more than you think, once it is tuned for AI traffic patterns instead of generic web categories. That tuning is most of the work, and it is what Brixio operates on the Cloudflare Zero Trust stack.
The next surface
How do you discover shadow AI agents and non-human identities?
Inventory the API keys and OAuth grants that reach LLM endpoints, then treat every agent as an identity with a scope and an owner. Detection built for people pasting text into a chat window does not see an agent acting on its own credentials. This is the fastest-growing blind spot, and it is already in most estates.
01
Agents inside sanctioned SaaS
Copilots and assistants shipped inside tools you already pay for read whatever the connected account can read. Nobody signed up for anything, so CASB sees nothing: the data access is inherited rather than granted.
02
Coding agents in the IDE
An assistant with repository access and a terminal can read secrets, push branches and call external APIs. The traffic looks like developer traffic, and the LLM call often leaves from the developer's machine rather than your network.
03
Machine identities and API keys
A key issued once for a proof of concept keeps working long after the project is dropped. These non-human identities rarely appear in joiner-mover-leaver processes, and no employee survey will ever surface them.
The practical answer is to extend the same discovery loop rather than open a second program: inventory the API keys and OAuth grants that reach LLM endpoints, log the egress, and treat every agent as an identity with a scope and an owner. The AI Security pillar covers the architecture, and identity-based Zero Trust access is where that scope is actually enforced.
The scenario
From employee to incident: anatomy of a ChatGPT code leak.
Here is the exact scenario we encounter across most organizations we support:
Step 1
The friction point
A backend developer faces a complex bug at 4:45 PM on a Thursday. The hotfix must ship by Friday morning. The company's official AI assistant is too slow, or hasn't been deployed to their team yet.
Step 2
The workaround
They open ChatGPT in a browser tab using a personal account, and paste 40 lines of code containing, by oversight, a hardcoded database connection string and an active API key.
Step 3
Habit formation
ChatGPT provides the fix in 15 seconds; the code is deployed. Because the company lacks AI-specific network detection, no alert is triggered. The developer, and their teammates via word of mouth, now adopt this workaround as a standard process.
Step 4
Real-time detection
If a DLP tool is properly deployed upstream of AI domains, this paste event triggers an immediate alert. The system flags the user, the target service, a redacted preview of the data, and a risk score.
Step 5
Triage and remediation
The security team qualifies the incident. The goal is remediation, not punishment: immediate revocation of the exposed API key, access verification for the affected databases, and incident logging.
Step 6
Structural fix
Instead of issuing an ignored corporate memo, the company grants the team immediate access to an approved, secure AI coding tool. The business need is met; the technical risk is eliminated.
Without detection, a data leak is often discovered months after the fact. With the right tools in place, it is mitigated the same day, which is why we run detection and response as a managed service.
The framework
Should you block shadow AI or govern it?
Strict bans are counterproductive. Blocking AI tools does not remove the pressure to deliver or the need for productivity, it simply forces employees onto personal smartphones or laptops. Your DLP, SWG and logs lose all visibility. With BYOAI rates at 78% (Microsoft and LinkedIn, 2024), an outright ban is a choice to operate blind.
Apply a risk-tiered decision framework
The golden rule: evaluate the combination of tool trust level and data sensitivity, not the tool alone.
| Signal | Concrete example | Recommended action |
|---|---|---|
| Sanctioned tool, low risk, no sensitive data | Grammarly for internal email drafting | Allow and log usage |
| Unsanctioned tool, no sensitive data detected | Free ChatGPT tier for creative brainstorming | Allow, display a warning banner, monitor |
| Unsanctioned tool, sensitive data detected | Source code or PII pasted into an unapproved tool | Block the transaction, alert security, coach the user |
| Sanctioned tool, policy violation | Official AI used for a project outside approved scope | Warn, log, review with team lead |
| High-risk tool, zero data control | Browser extension with ambiguous data-retention policies | Block strictly at the network layer |
Why this pragmatic approach wins
- It keeps traffic on monitored infrastructure instead of migrating to personal devices.
- It gathers real data on what teams actually need.
- It provides a proportionate response that preserves trust with business units.
Strict blocking should be reserved for tools that exploit your data to train public models with no enterprise opt-out. Pair governance with identity-based Zero Trust access so policy follows the user, not the network.
Not sure what your Cloudflare setup actually covers?
Metryx audits your Cloudflare appsec configuration, WAF mode, API coverage, client-side scripts, and maps each gap to a fix. A fast first read on the surfaces AI exposure rides on; full shadow AI detection runs as a managed service.
Run an express audit- Free access, no commitment
- Read-only Cloudflare token
- No configuration required
- Downloadable audit report to share internally
- Run as many audits as you want, on as many zones as you want
The rollout
Deploying shadow AI governance without stalling teams.
Technical controls are straightforward; the human rollout is the real challenge. To succeed, follow these operational principles:
01
Start with a pilot
Target a high-usage, moderate-risk team (marketing or engineering). Run detection in observe-only mode for two to three weeks to establish a real baseline before turning on any restriction.
02
Justify decisions with financial risk
Teams adopt guardrails when they understand the failure mode. Remind leadership that leaks involving unmanaged “shadow data” take longer and cost more to contain: in France, the average data breach reached €3.85 million in 2024 (IBM). That is the figure that aligns executives.
03
Provide an alternative before restricting
If you block an unsanctioned tool, provide a secure equivalent immediately. Users should perceive the change as a technical upgrade, not a restriction.
04
Build an expedited exception process
Unique workflows require specific tools. A weekly review process, not a six-month procurement cycle, stops impatience from driving workarounds.
05
Track adoption, not just violations
A purely punitive dashboard loses executive backing. Measure success with three metrics: official tools deployed, time-to-approval for new requests, and the month-over-month decline in unsanctioned traffic.
06
Update your AI acceptable use policy
The AI landscape shifts monthly. An AI acceptable use policy reviewed once a year is obsolete: build a quarterly review into the program from day one, and name the sanctioned tools in it rather than only the banned ones.
The legal stakes
What does shadow AI change for GDPR and the AI Act?
Shadow AI is a major legal liability, not only a security one.
GDPR
Employees pasting customer data into uncontracted AI platforms create undocumented transfers outside the EU to unknown sub-processors. This invalidates your Record of Processing Activities (RoPA) and Data Protection Impact Assessments (DPIA), a critical non-compliance risk during a CNIL audit.
European AI Act
The regulation mandates mapping, documenting and classifying the risk level of every AI system used in the enterprise. Deploying shadow AI detection today establishes the precise technical baseline required to meet these upcoming legal obligations.
The same inventory feeds the sector regimes: an unsanctioned AI tool processing operational data is an unregistered third-party dependency under NIS2, and the transfer question is a data sovereignty question before it is a security one. Map once, report to each.
The managed service
The Brixio approach: managed shadow AI governance.
Brixio doesn't just deliver static audit reports. We manage your AI governance as an ongoing service:
Continuous shadow AI monitoring
- Real-time analysis of network traffic, DLP paste-events and endpoint application inventories
- AI usage monitoring per team, so the map shows who needs a sanctioned tool next
- A living shadow-AI map, kept current as new tools launch
- A standing cadence, not a quarterly rediscovery
Cloudflare Zero Trust & AI Gateway stack
- AI Gateway and Zero Trust Gateway in front of AI traffic
- Custom DLP policies tuned to your actual data flows
- Interception of source code, infrastructure secrets and PII
SLA-backed incident response
- Every leak alert instantly qualified and remediated by our SOC
- Isolation and secret revocation built into the response
- Same-day catch instead of same-year discovery
Change management
- We run the pilot phase and train your teams
- We streamline the rollout of secure alternatives
- Organizational alignment, because a policy nobody adopts isn't a working program
AI traffic from every source converges on one Cloudflare policy plane: seen, scored and routed by risk, with Brixio operating it 24/7 on Brixio One.
This runs on Brixio's standing security posture
Cloudflare
Authorized Service Delivery Partner
ISO 27001:2022
certified data handling
400+
delivered projects in regulated industries
4 hubs
Luxembourg · Paris · Dubai · Singapore, follow-the-sun
This sits inside our broader AI Security practice and the same managed SOC that runs Zero Trust and DORA programs for regulated clients. Talk to an expert to scope it against your own environment.