The 15-Minute Shadow AI Check
Find out whether employees are already sending company data to ChatGPT, Copilot, Claude, Gemini, and other cloud AI tools. No software to buy. No sign-up required.
Search your DNS or firewall logs
In your firewall, DNS filter, or web proxy, search the last 30 days for requests to these domains. Note the number of requests and the number of distinct internal devices.
Check browser extensions
If you manage Chrome or Edge, list installed extensions with “AI,” “GPT,” “Copilot,” or “Grammarly” in the name. Many AI extensions can read the page a user is viewing, including internal web apps.
Just ask
Send a one-question anonymous survey: “In the last month, have you used an AI tool for any work task? Yes / No / Prefer not to say.” Personal phones won’t show up in your logs, but they will show up here.
What your numbers mean.
Great, but re-run it quarterly. Usage tends to grow quietly, and personal devices don’t appear in your logs.
Normal. Time to write an AI acceptable-use policy that says what data can and can’t go into AI tools, and to give people an approved option.
Controlled or confidential data may be leaving. Loop in your security officer, FSO, or compliance lead, and prioritize a sanctioned alternative so people stop working around you.
Five questions for any AI tool, before data goes in.
- Where does the prompt physically go? Which company, which country?
- Is it used to train their models? Check the actual terms, not the marketing page.
- Who at your company can see what employees typed?
- Does it fit your contract clauses? DFARS 7012, BAAs, client engagement letters, NDAs.
- What happens to the data when you cancel?
Found something? Let’s talk through it.
We’ll help you read the results for free, and if you need a safe alternative to give your team, we’ll show you one that runs inside your building.