How do you audit shadow AI in a 100-person company?

What is the fastest way to audit shadow AI in a 100-person company?

Start with a two-week discovery sprint, not a hunt for guilty employees. Export OAuth app grants from your identity system, review DNS or secure web gateway logs for AI domains, and run an anonymous five-question survey. Then compare the three lists. That gives you a usable map of tools, data risk, and unmet needs without pretending that network logs can see a prompt copied onto a personal phone.

I would put one person from IT, operations, legal or HR, and a department that uses AI heavily in the room. Give them a narrow brief: find unsanctioned tools, understand why people chose them, and move the legitimate work into an approved path. The audit is a security project. It should not quietly become employee performance surveillance.

Which signals should you collect first?

Begin with identity because it is often the cheapest signal you already own. In Google Workspace's API controls, review third-party apps and OAuth scopes. In Microsoft Entra's enterprise application reports, review consent grants and permissions. Look for AI note-takers, inbox assistants, browser extensions, and tools asking for broad access to Drive, Gmail, SharePoint, or Git repositories.

OAuth tells you which apps received permission. It does not tell you what an employee typed into a consumer chatbot. Keep that limitation visible in the report.

Next, inspect DNS, proxy, or secure web gateway data for domains such as chatgpt.com, claude.ai, gemini.google.com, perplexity.ai, and niche tools discovered in the survey. A DNS record can show that a device resolved a domain. It cannot show the prompt or prove that company data was uploaded. TLS inspection may reveal more, but it adds certificate deployment, privacy, and maintenance work. I would not start there for a 100-person company.

If the business already pays for Microsoft 365, check whether Cloud App Discovery is available in its licensing before buying another product. Microsoft documents Cloud App Discovery as a way to analyze traffic logs and risk-score cloud apps. If you use Cloudflare Zero Trust, read the current plan terms before budgeting. Cloudflare's published pricing page lists a free tier capped at 50 users and a pay-as-you-go option priced per user, but vendor limits and packaging change. Treat the page as a procurement source, not as a permanent fact.

How do you ask employees without making the audit useless?

Run an anonymous survey before you block anything. Ask five questions: which AI tools do you use, what task does each tool save time on, what information goes into it, what approved tool would you use instead, and what stops you from using the company-approved option? Keep names out of the response form unless there is a separate, documented incident process.

The survey matters because logs miss personal browsers, mobile devices, and tools used through a colleague's account. It also tells you where the company created the shadow behavior. A sales team may be pasting call notes because the sanctioned CRM has no usable summarizer. An agency may be using a niche transcription service because the approved suite cannot handle client recordings. Block the tool without fixing that gap and the behavior moves somewhere you can see even less.

Tell employees what you collect, why you collect it, who can access it, and how long it will be retained. The UK ICO worker-monitoring guidance says employers should be transparent about monitoring and carry out a Data Protection Impact Assessment for high-risk monitoring. In the EU, the proportionality question is real: security logging can have a legitimate purpose, while continuous keystroke logging or using security logs to grade performance is a different proposition. Get local counsel or your data-protection lead involved where required.

How should you classify data before approving AI tools?

Use three traffic-light categories. Keep the labels boring so employees remember them.

• Green: public material, published product information, and generic formatting tasks.
• Amber: internal plans, de-identified customer notes, source code, and financial forecasts. Allow these only in a contracted business workspace with the right administrator and data terms.
• Red: passwords, API keys, raw personal data, health information, legal privilege, and unannounced transactions. Do not put these into an external AI tool unless the agreement and technical controls explicitly cover that use.

NIST's Generative AI Profile, NIST AI 600-1, published in July 2024, connects governance with data protection, testing, content provenance, and incident disclosure. You do not need to reproduce the document as a 40-page policy. Use it to justify the simple question employees actually need answered: what may I paste into which tool?

Be precise about commercial terms. A business workspace may provide different training, retention, administrative, or contractual controls than a consumer account. Those controls vary by vendor and plan. Link to the vendor's current privacy and security documentation in your registry, and assign someone to review it. “Business” in a product name is not a substitute for reading the agreement.

What should you do with the tools employees already found?

Create a registry with four columns: tool, approved use, data tier, and owner. Add a fifth column for the next review date. Start with the tools that appear in both the logs and survey, then sort them by data access. An AI tool with no OAuth permissions and only Green inputs is a different problem from an inbox assistant with read and write access to every mailbox.

Migrate useful work in stages. Pick one approved workspace for general text work, one transcription path if calls are important, and existing suite features where they meet the requirement. Give teams a short migration window and a place to report missing capabilities. I prefer a small number of approved routes over a catalogue of 30 products nobody can evaluate.

Do not promise that approval makes leakage impossible. It reduces uncertainty and gives administrators somewhere to look. People will still make mistakes. The goal is to make the safe path faster than the workaround.

What happens when the audit finds a real data leak?

Treat a confirmed paste of sensitive data as an incident, not as a policy debate. First, preserve enough evidence to understand what was exposed. Then revoke the relevant OAuth grant or account access and rotate credentials, tokens, or API keys that appeared in the prompt. Ask the employee to delete the conversation where appropriate, but do not assume deletion removes copies already sent to a third party.

Bring in the person responsible for privacy and contracts. They can decide whether the event triggers customer notice, a regulator clock, or a contractual notification. NIST SP 800-61 Rev. 3, published in April 2025, frames incident response around the CSF 2.0 functions, including Govern, Identify, Protect, Detect, Respond, and Recover. That is a useful structure for the post-incident review: which control failed, why did the employee choose the tool, and what change will prevent a repeat?

What can a shadow AI audit never tell you?

It cannot give you perfect coverage. A managed laptop may show a DNS request while a personal phone shows nothing. An OAuth report may reveal access but not the contents of a chat. Local coding agents and command-line tools can use a person's existing credentials without creating the same central SSO trail as a SaaS login.

Say that plainly in the audit report. Then spend the budget on the controls that change behavior: clear data tiers, visible approved tools, sensible access reviews, and a survey employees can answer without fear. For a 100-person organization, that will beat building a miniature surveillance state.

If you want help turning the findings into an approved-tool registry and a short policy, contact us. We can start with the tools your team is already using, which is more useful than pretending the blank spreadsheet is the truth.