Nobody Told Your IT Team About the AI Apps Employees Are Using
In this article
Bottom line: Microsoft's 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work — a trend researchers call BYOAI — often without ever looping in IT or security.
I spent three weeks last month auditing a mid-size logistics company's actual AI footprint and found 41 distinct AI tools in active use against a sanctioned list of four.
If you run infrastructure or security for a company with more than 50 employees, you almost certainly have the same gap, and you don't know its size until you go looking for it.
I asked a client's CISO how many AI tools her company used. She said four: ChatGPT Enterprise, GitHub Copilot, a sanctioned transcription tool, and an internal chatbot nobody liked.
Then I ran a network log pull against known AI-vendor domains and found forty-one.
That gap between "what we approved" and "what people actually use" is the whole story. It's not a hypothetical risk anymore — it's the default state of every company I've walked into this year.
The Setup: An Audit I Didn't Expect to Be This Boring — or This Bad
I got called in to do a routine infrastructure review in July 2026, the kind of engagement where you're mostly checking VPN configs and SSO coverage.
Somewhere in the middle of pulling DNS logs, I noticed traffic to domains I hadn't seen on the sanctioned-vendor list: writesonic.com, otter.ai, character.ai, a half-dozen "AI notetaker" browser extensions, and — this one got my attention — a Chrome extension called an AI meeting summarizer that had write access to the calendar API for 200-plus accounts.
Nobody had approved any of it. Nobody in IT had even heard of most of it.
Employees had just signed up with their work email, because the free tier worked, and because asking IT for a new tool usually means a ticket that sits for three weeks.
That's the actual failure mode here, and it's not a people problem. It's a process latency problem.
When your approval pipeline is slower than a Google search and a credit card, employees will always route around it.
I've watched this happen with SaaS tools for a decade.
AI just made it worse, because the tools got good enough — and cheap enough — that the value is obvious to a 24-year-old marketing associate in about ninety seconds.
The Core Insight: Shadow AI Isn't Shadow IT With a New Coat of Paint
I want to push back on how most security teams are framing this, because I think they're using the wrong mental model.
Shadow IT — the Dropbox-instead-of-the-sanctioned-file-share problem from the 2010s — was mostly about storage and access. The risk was: someone puts a spreadsheet somewhere you don't control.
Bad, but bounded. You could find it, you could revoke it, the blast radius was a folder.
Why the data exposure is structurally different this time
Shadow AI is different because the tools don't just store your data — they process it, and in many cases they train on it or route it through a third-party model provider whose retention policy nobody at your company has read.
When an employee pastes a customer contract into a free-tier chatbot to "summarize the key terms," that text doesn't sit in a folder.
It goes through an API, potentially gets logged by the vendor, and in some documented cases gets used to fine-tune a model that other customers query later.
Samsung learned this the hard way in 2023 when engineers pasted proprietary source code into ChatGPT to debug it, and the company banned generative AI tools company-wide within weeks.
That was three years ago and it was treated as a wake-up call. It didn't wake anyone up.
It just moved the behavior further underground, because the tools kept getting better and the bans kept getting worked around with personal devices and personal accounts.
The part nobody's measuring: identity sprawl
Here's what my audit actually turned up that surprised me most. It wasn't the data exposure — every security person expects that risk by now. It was the identity sprawl.
Forty-one tools meant forty-one sets of credentials, and at least a dozen of those tools had been granted OAuth access to Google Workspace or Microsoft 365 accounts.
That's not "someone used a chatbot." That's forty-one third-party vendors with standing, revocable-in-theory-but-nobody's-tracking-it access to corporate email, calendar, and file storage.
When I mapped it out, six of those OAuth grants were still active for employees who had left the company. IT had deprovisioned their SSO.
Nobody had touched the AI tool's separate OAuth grant, because nobody knew it existed.
Developers are the biggest blind spot, not the smallest
Everyone assumes the shadow AI problem is marketing interns and sales reps pasting things into ChatGPT.
In my experience it's actually worst among engineers, because engineers are the group most likely to have the technical comfort to wire an API key into a script and never mention it to anyone.
I've seen production log data piped through a third-party summarization API for "debugging convenience." I've seen a CI pipeline calling an external LLM endpoint with an API key sitting in plaintext in a repo, because it was faster than requesting one through the sanctioned procurement path.
This tracks with a pattern I've written about before — the gap between how developers actually work day-to-day and how vibe coder productivity gets measured and managed from above.
The tools move faster than the org chart does, every single time.
The Reality Check: You Cannot Ban Your Way Out of This
The instinct — and I've watched three different security teams reach for this instinct this year — is to block every AI domain at the firewall and call it solved.
It doesn't work, and I'd argue it makes things worse.
Blocking known AI domains catches maybe 60% of usage, generously. New AI tools launch weekly.
Employees switch to mobile data or personal devices for the rest, which means the activity still happens — you've just lost visibility into it entirely.
At least when it's happening on the corporate network, you can see it in the logs.
I'll be honest about where I've been wrong here too.
A year ago I would have told a client that a strict allowlist was the right call — approve a handful of enterprise-tier tools, block everything else, done.
What I've actually seen play out is that the allowlist approach only holds if the approval process is fast enough to compete with a free signup.
If it's not — and at most companies it isn't — you get exactly the shadow ecosystem I found in that audit, just with extra friction and worse morale on top.
The tools genuinely are useful. That's the part security teams underweight. An employee using an AI meeting summarizer isn't being reckless for fun — they're saving ninety minutes a week.
The fix has to compete on value, not just restrict on risk.
The Practical Takeaway: Build the Fast Path Before You Build the Wall
If you're running infrastructure or security and you haven't done what I did — pulled DNS and proxy logs against a list of known AI vendor domains — do that this week.
It's a few hours of work and it will change how you think about your risk surface. You will find more than you expect. Everyone does.
Once you have the actual list, here's the sequence that's worked when I've helped companies fix this, roughly in order:
- Inventory before you restrict. You cannot govern what you can't see. CASB tools and DNS log analysis get you 80% of the way there in a day, not a quarter.
- Cut approval time to under 48 hours for a defined, low-risk tier of AI tools. If your process is faster than a free signup, most employees will use the sanctioned path voluntarily. This is the single highest-leverage change available to you.
- Treat OAuth grants like credentials, not like preferences. Audit third-party app access to your identity provider quarterly, and revoke automatically on offboarding — don't rely on someone remembering.
- Give engineers a sanctioned API gateway for LLM calls, with logging and spend limits, so there's no reason to hardcode a personal key into a script. Make the easy path also be the safe path.
- Stop treating this as a one-time ban. New tools launch every week. This needs to be a standing review cadence, not a policy you set once and file away.
None of this is exotic. It's the same discipline that eventually tamed Dropbox-era shadow IT — visibility first, friction reduction second, enforcement last.
AI just compressed the timeline from years to months.
Where This Actually Goes
I don't think the answer is fewer AI tools in the enterprise.
I think the answer is that most IT and security orgs are still operating on a 2015 assumption — that software adoption is slow enough for a review committee to keep pace with it.
That assumption died sometime in early 2025 and most org charts haven't caught up.
The companies that get ahead of this aren't the ones with the strictest ban list. They're the ones who made the sanctioned path faster than the workaround, so employees stopped needing one.
Have you actually pulled your own DNS logs against AI vendor domains, or are you still working off the "official" tool list your company published two years ago?
I'd genuinely like to know how big the gap is where you work.
