Shadow AI and the agent inventory
People in your company already use AI tools and agents you never approved. You cannot secure what you cannot see, so the first job is to find them and write them down.
In 60 seconds
Shadow AI and the agent inventory
People in your company already use AI tools and agents you never approved. You cannot secure what you cannot see, so the first job is to find them and write them down.
Where to look
| Source | What it can reveal | Limits |
|---|---|---|
| Single sign-on (SSO) logs | Which AI apps people sign in to with their work account | Misses tools used with personal accounts |
| OAuth app grants | Third-party apps and agents given access to mail, calendar, files or code | Shows the grant, not how the data is used |
| Web proxy, DNS and CASB logs | Traffic to AI services from company devices and networks | Misses personal phones and home networks |
| Expense reports and card statements | Paid AI subscriptions bought by teams or individuals | Misses free tiers |
| Code and package scans | AI SDKs, API keys and agent frameworks inside repositories | Only covers code you can scan |
| Endpoint and browser-extension inventory | Desktop agents, local MCP servers, AI browser extensions | Needs device management in place |
| Simply asking people | Why they use the tool and what problem it solves | People forget or under-report |
What one inventory row should hold
name | meeting-notes-bot
owner | Priya S., Sales Operations (named person, not a team alias)
purpose | Joins sales calls, writes summaries into the CRM
data | Call audio, customer names, deal values (confidential)
tools | calendar.read, crm.notes.write
identity | Its own service identity; acts on behalf of the meeting host
vendor/model| External SaaS vendor; model provider listed in contract
where data goes | Vendor cloud region (check contract)
approved? | Yes, risk tier: medium, review due: next quarter
name | "free PDF summariser" browser extension
owner | Unknown (found in browser-extension scan)
data | Anything open in the browser
tools | Reads all pages, sends text to an unknown server
approved? | No -> contact users, offer approved alternative, then removeApproved alternatives beat bans
- "All AI tools are blocked" email
- Staff switch to personal phones and accounts
- The use continues, now completely invisible
- Security learns about it after a leak
- An approved assistant with a company contract and data controls
- A simple request form for new tools, answered in days, not months
- Clear rules: what data may go where
- Blocking only for tools that are clearly unsafe, with a reason given
- 1
Discover
Pull SSO, OAuth, proxy and expense data. List every AI tool and agent you find. - 2
Triage
For each one: what data, what access, who uses it. Sort by risk. - 3
Decide
Approve, approve with conditions, replace with an approved tool, or remove. - 4
Register
Every approved agent gets an owner, a purpose and a review date in the inventory. - 5
Repeat
Shadow AI comes back. Run discovery on a schedule, not once.
Watch and read more
Lab
A first agent inventory sheet with at least five rows and a decision for each.
The problem
Build an agent inventory for your team or an imaginary company. Use real tools you know people use, but do not include any secrets or personal data.
- Copy the starter columns into a spreadsheet.
- Add at least five AI tools or agents. Include at least one you would call "shadow AI".
- For each one, fill in data, tools/permissions and a named owner (a role is fine in a practice sheet).
- Give each a decision: approve, approve with conditions, replace, or remove. Write one line explaining why.
- Write down which discovery source (SSO, OAuth grants, proxy, expenses, asking people) would have found each one.
name,owner,purpose,data_it_touches,tools_and_permissions,acts_as,reads_untrusted_content,vendor_and_region,decision,reason,review_date,found_via
meeting-notes-bot,Sales Ops lead,Call summaries into CRM,customer names; deal values,calendar.read; crm.notes.write,own identity on behalf of host,yes (call audio),SaaS vendor; check contract,approve with conditions,needs data retention limit,next quarter,OAuth grants
You are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1A team says, "We only use the free version, so there's no contract and no risk." How do you respond?Reveal
No contract often means more risk, not less: you may have no promise about how long data is kept, whether it is used for training, or where it is stored. The risk depends on the data and access involved, not the price. Record it, check the tool's terms, and offer an approved option if company data is going in.
Q2Why is "reads untrusted content" a useful column in an agent inventory?Reveal
Because it tells you whether an outsider can put words in front of the agent: emails, web pages, tickets, shared documents. Combined with private data and a way to send things out, that is the lethal trifecta. The column lets you quickly find the agents that most need tight tools, approvals and monitoring.
Questions people ask
Is shadow AI always a security problem?
Not always. Many tools are harmless for the data people use them with. The problem is not knowing. Once a tool is in the inventory with an owner and a data rule, it stops being shadow AI, whether you approve it or not.
What about personal phones and home networks?
Technical discovery will never see everything. That is why approved alternatives and clear rules matter: people who have a good approved tool have less reason to use an unknown one. Surveys and simple conversations fill some gaps.
Who should own an agent in the inventory?
A named person in the business team that uses it, not only IT or security. They know what it is for and can answer "do we still need this?" at review time. Security owns the process, not every agent.
How is an agent inventory different from a normal software inventory?
It adds the things that decide an agent's blast radius: what tools it has, what data it can reach, whose identity it acts with, and whether it reads untrusted content. A normal software list usually stops at name, version and licence.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.