Shadow AI: find it, govern it, replace it

What counts as Shadow AI

Any AI path that bypasses approved identity, data handling, and spend controls—whether a browser chatbot or a hidden microservice key—is Shadow AI from a risk perspective.

Classic symptoms: unknown OpenAI invoices, prompts pasted into consumer tools with customer PII, agents running on a developer’s personal Foundry project, and no inventory of which prompts changed last week.

Shadow AI is usually a productivity signal, not malice. Teams adopt whatever unblocks shipping. Governance that only says “no” without offering a paved road fails.

Why it matters to security and finance

Shadow AI breaks least privilege, retention policies, and chargeback. You cannot answer questionnaires about prompt ownership or key blast radius if you do not know the inventory.

A single leaked personal API key can expose customer content or rack up unbudgeted spend. Consumer tools may retain prompts under terms your DPA never covered. Finance cannot attribute cost to products when usage lives outside the ledger.

Regulated industries increasingly ask for immutable audit evidence of AI API calls. Optional APIM → Log Analytics patterns help when enabled and verified—see /ai-observability and /ai-compliance.

How to detect Shadow AI

Combine network and SaaS discovery with developer interviews and cloud bill anomalies—then offer a migration path into governed workspaces.

• Scan expense reports and cloud bills for unexpected AI vendors or orphaned Foundry projects.
• Ask product teams which keys live in CI secrets and which chat UIs they use for customer data.
• Inventory agents and prompts; if nobody can answer “who changed that system prompt?”, you have Shadow AI.
• Review outbound HTTPS destinations from production for consumer LLM endpoints.

Kimss covers one specific half of this. Any agent whose traffic you route through the gateway becomes inventory automatically — but Kimss does not scan your network or your SaaS estate. Endpoint, DNS, and DLP discovery stay with the tooling you already own. Use those to find where traffic goes; use Kimss to name, attribute, and govern it once it points at the gateway.

The two-minute shadow agent audit

Count the agents your teams are running. Now count the rows in your agent inventory. If the second number is smaller, the difference is your shadow agent problem — and it is the one number most AI programs cannot produce on demand.

Kimss produces both numbers in an afternoon. Route existing traffic through the gateway with a one-line base_url change and every distinct agent the gateway sees becomes an inventory row — no code annotation, no SDK migration, no model change. Unattributed calls arrive labelled by model: one row per model, “Discovered · gpt-4o”, “Discovered · claude-sonnet”, and so on. Send an X-Kimss-Agent-Id header and the row carries your own name for the agent instead.

Four agents on four different models produce four rows the first time they call — including the ones nobody remembered to mention in the architecture review. That inventory, not a spreadsheet, is what security questionnaires are asking for.

• Register — declare an agent you already run. Inventory only.
• Report — push token usage from your runtime. Labelled self-reported.
• Route — proxy calls through the gateway. Labelled gateway-verified, with the kill switch and governed-request caps enforced mid-hop.

The distinction matters under audit: only routed traffic is gateway-verified. Registered and self-reported rows are inventory hygiene, never Article 12–grade evidence. Full steps are in Register agents and models.

How Kimss eliminates Shadow AI

Give every team a workspace with Entra login, scoped API keys, governed-request allowances, and a stable /v1 API—so the sanctioned path is the fastest path.

Kimss makes shadow agents visible the moment their traffic flows through the gateway: every distinct agent becomes an inventory row with an owner, a model binding, an authoritative kill switch, and a governed-request meter. A disabled agent is refused at the gateway, not asked politely to stop. Builders embed agents via SDK or MCP instead of pasting secrets into notebooks.

Pair this page with /ai-governance-for-enterprises, /ai-spend-caps-and-credits, and /multi-tenant-ai-security for the full control-plane story.

Frequently asked questions