Blog Article
How to Detect Shadow AI in Your Organization: A Technical Deep-Dive
69% of organisations suspect or have evidence that employees use prohibited public GenAI (Gartner, 2025). Most have zero visibility into that usage. This technical guide details shadow AI detection methods — network traffic analysis, endpoint monitoring, browser extension detection, proxy logs, and DNS filtering — and their respective limitations.
Why Shadow AI Detection Is Different
Traditional security tools were designed to detect threats on known channels: email, cloud storage, file transfers. Shadow AI uses a different channel: the web browser. Employees type sensitive data directly into web forms on AI platforms — no downloads, no attachments, no identifiable file transfers. The data flow is both inbound (prompt) and outbound (response), and it is encrypted in TLS 1.3.
This fundamental difference explains why network DLP, CASB, and proxies are insufficient. They see traffic volume to AI domains but not the content of exchanges. They can block a domain but cannot distinguish a prompt containing an IBAN from a harmless prompt. Effective shadow AI detection requires a browser-level approach — where data is entered, before it is encrypted.
The 5 Detection Layers
1. Network Traffic Analysis
Network traffic analysis identifies connections to known AI domains (chat.openai.com, claude.ai, gemini.google.com, copilot.microsoft.com) as well as hundreds of lesser-known specialized tools. Key indicators include outbound data volume (long prompt uploads = high probability of sensitive data), access frequency, usage hours, and anomalous patterns.
Limitation: network analysis only sees volume and destination, not content. Since traffic is encrypted in TLS 1.3, deep packet inspection (DPI) is ineffective without decryption, which raises legal privacy concerns in several European jurisdictions.
Effectiveness: low for content detection, good for tool discovery
2. Proxy Logs and CASB
Web proxies and Cloud Access Security Brokers (CASB) intercept HTTP/S traffic and can identify visited AI domains. They provide visibility into who accesses which tools, at what frequency, and what data volume is transferred. A CASB can block access to specific domains or apply category policies (block all “content generation” tools).
Limitation: CASBs only see the domain, not the prompt content. Moreover, many employees bypass proxies via personal VPNs, mobile hotspots, or unmanaged browsers. The experience is clear: CASBs block entire domains, which also blocks legitimate uses (email drafting, code assistance) and pushes employees toward workarounds.
Effectiveness: medium for discovery, low for content, bypassable
3. DNS Filtering
DNS filtering operates at the domain name resolution level. By blocking or logging DNS queries to known AI domains, you gain basic visibility into usage. The advantage is deployment simplicity: you only need to configure the organization's DNS servers.
Limitation: DNS does not distinguish subdomains (chat.openai.com vs platform.openai.com), does not see content, and is easily bypassed via alternative DNS resolvers (1.1.1.1, 8.8.8.8) or DoH (DNS over HTTPS). It is a necessary first step but insufficient.
Effectiveness: low, easily bypassed, good as a first indicator
4. Endpoint Monitoring
Agents installed on workstations (EDR/XDR) can detect the execution of local AI applications (desktop interfaces, code generation tools like Cursor or GitHub Copilot in desktop mode) and monitor the clipboard to detect copy-paste of sensitive data. Some advanced EDRs offer specific content classification modules.
Limitation: endpoint monitoring is intrusive, resource-intensive, and does not cover personal devices (BYOD). It raises employee privacy concerns, particularly in European jurisdictions where workplace privacy rights are protected. It also does not see AI tools used via the web browser, which is the primary shadow AI channel.
Effectiveness: good for local apps, blind for browser usage
5. Browser-Level Detection (Noxys Approach)
Browser-level detection operates where shadow AI actually happens: in the web browser. An extension deployed via enterprise policy (MDM, GPO, Chrome Enterprise) intercepts interactions with AI platforms before TLS encryption. It can read prompt content in real time, identify sensitive data (PII, IBANs, secrets, health data) and apply policies: block, coach, or log.
This approach has three decisive advantages. First, complete visibility: not just the visited domain, but the exact content of each exchange. Second, granularity: blocking or coaching at the prompt level, not the entire domain. Third, deployability: under 10 minutes via existing policies, with no proxy, no network changes, no heavy agent on the workstation.
Effectiveness: high, covers the primary shadow AI channel
Detecting AI Browser Extensions
AI browser extensions represent a particularly insidious shadow AI vector. An AI writing extension may have access to the content of every web page visited — including intranets, CRMs, HR tools. In March 2025, security researchers identified over 40 malicious or risky AI browser extensions in the Chrome Web Store, with more than 2 million cumulative installations.
Extension detection requires browser-level inventory. Chrome Enterprise policies and Windows GPOs can list installed extensions and block unapproved ones. Noxys integrates this detection in its browser monitoring solution, automatically identifying AI extensions and their risk level.
Automatically Classifying Sensitive Data
Detecting that an employee visits chat.openai.com is the first step. Detecting that they enter an IBAN, a social security number, or a trade secret is the real value-add. Automatic sensitive data classification uses NLP models trained on PII (Personal Identifiable Information) patterns to identify in real time the nature of data entered in a prompt.
Critical categories to detect include: personal data (name, address, IBAN, social security number), health data (medical records, genetic information), financial data (revenue, credit scores, internal accounting reports), trade secrets (source code, formulas, product strategies), and credentials (passwords, API keys, access tokens).
Detection must operate in under 10 milliseconds to avoid degrading the user experience. Beyond that, employees disable the extension or bypass the solution. Noxys achieves this latency threshold through lightweight NLP models optimized for client-side execution, with no data sent to external servers.
Noxys Detection Architecture
The Noxys detection architecture combines three complementary layers for complete shadow AI coverage:
Layer 1: Browser Extension
Deployed via MDM/GPO/Chrome Enterprise in under 10 minutes. Intercepts prompts in real time before TLS encryption. Classifies sensitive data (PII, secrets, health data) in under 10ms. Applies blocking, coaching, or logging policies at the prompt level.
Layer 2: AI Tool Inventory
Catalogs all AI tools used in the organization — web, extensions, desktop applications, API integrations. For each tool, Noxys evaluates server location, data-use policy, GDPR compliance, and enterprise SSO support. The inventory is continuously updated.
Layer 3: Audit Trail
Immutable log of all interactions with AI tools. Each prompt, each response, each applied policy (blocking, coaching, logging) is recorded with timestamp, user ID, detected data type, and tool used. Exportable for auditors and regulators.
Detection Methods Comparison
| Method | Content Visibility | Bypassable | Deployment | Privacy |
|---|---|---|---|---|
| R\u00e9seau / DPI / DPI | Low | VPN/Tor | Weeks | Inv |
| CASB / Proxy | Medium | Pers. VPN | Weeks | Inv |
| DNS Filtering | None | DoH | Hours | \u2713 |
| EDR / Endpoint | Medium | BYOD | Days | Intrusive |
| Noxys (Navigateur) | High | Minimal | 10 min | \u2713 |
Detection Metrics to Track
Once detection is in place, track these key indicators to measure effectiveness and steer policies:
Discovery Rate
Percentage of actually used AI tools that are detected. Target: 95% within the first 30 days. A rate below 80% indicates blind spots (unlisted tools, bypasses).
Sensitive Data Detection Rate
Percentage of prompts containing sensitive data that are correctly identified. Target: 99% for critical PII (IBANs, SSNs), 95% for generic sensitive data. A lower rate indicates the classification model needs recalibration.
Latency
Processing time between prompt entry and alert or coaching display. Target: under 10ms. Beyond that, users disable the extension.
False Positive Rate
Percentage of alerts that do not contain actual sensitive data. Target: under 5%. A high rate desensitizes employees and reduces coaching effectiveness.
Detect Shadow AI in Your Organization
Noxys provides complete visibility in under 10 minutes. Start on the free discovery tier. No credit card required.
FAQ
Is browser-level detection GDPR-compliant?
Yes, provided GDPR principles are respected: legitimate purpose (data security), data minimization (only collecting what is necessary), transparency (informing employees), and data subject rights. Noxys processes data client-side whenever possible and only transfers necessary metadata to its servers (tool used, detected data type, applied policy), never prompt content.
Can employees bypass or disable the extension?
Chrome Enterprise policies and Windows GPOs can force installation and prohibit extension removal. If an employee attempts to uninstall the extension via an unauthorized method, the event is logged and an alert is sent to the security team. Unauthorized uninstallation is treated as a security event.
What is the difference between blocking and coaching?
Blocking prevents the action: the prompt containing sensitive data is not sent. Coaching displays an educational message before the action, allowing the employee to understand the risk and decide whether to proceed. Coaching is generally more effective because it educates without frustrating, and employees who understand risks are 3 times more likely to permanently change their behavior.