Shadow AI discovery tools compared: what each one can see
The five data sources behind every shadow AI tool, the free reports you already have, and over a dozen products compared on what they find and what they cost.
TL;DR
- Shadow AI is the AI apps, agents and connectors people use at work without IT knowing. In Microsoft and LinkedIn's 2024 survey, 78% of AI users said they bring their own AI tools to work (Work Trend Index 2024).
- In IBM's 2025 breach study, one in five organizations reported a breach due to shadow AI (IBM).
- Every discovery tool reads one or more data sources: OAuth grants, sign-in logs, a browser extension, network traffic, or an agent on the laptop. Each source misses something the others catch.
- Google Workspace and Microsoft Entra already show which third-party apps people have connected, for free (Google; Microsoft).
- Coding agents and MCP servers on laptops need an endpoint view. Jamf, Harmonic, Noma and Prompt Security (now SentinelOne) are among the vendors that added one in 2025 and 2026.
- Two tools in this article publish a price: Nudge Security and Push Security.
Facts were checked on vendor pages on 15 October 2026. Caspian publishes this article and sells discovery as part of its product. Where we give an opinion, we say so.
How much shadow AI is there
| Finding | Source | Date | Confidence |
|---|---|---|---|
| 78% of AI users bring their own AI tools to work. About 31,000 people surveyed in 31 countries. | Microsoft and LinkedIn, Work Trend Index | May 2024 | High |
| Of workers using generative AI at work, over half do so without formal approval from their employer. | Salesforce | Nov 2023 | High |
| 32.3% of ChatGPT use at work goes through personal accounts. | Cyberhaven | Feb 2026 | High (vendor data) |
| One in five organizations reported a breach due to shadow AI. High shadow-AI use added $670,000 to the average breach cost. | IBM, Cost of a Data Breach 2025 | Jul 2025 | High |
| Gartner predicts that by 2030 more than 40% of enterprises will have security or compliance incidents linked to shadow AI. | Gartner | Nov 2025 | Medium (press release could not be loaded; wording from press coverage) |
Five ways to discover AI tools
Every product in this category combines some of these sources. Knowing which ones a tool uses tells you what it will miss.
| Data source | What it sees | What it misses |
|---|---|---|
| OAuth grants from Google Workspace or Microsoft Entra | Apps people connected with their work account, with the scopes granted | Tools used with a personal account or a password |
| Sign-in and SSO logs | Apps behind your identity provider | Everything not behind it |
| Browser extension | Sign-ins and use in the browser, including personal accounts on work laptops | Desktop apps, terminals, phones, unmanaged browsers |
| Network or SSE proxy | Traffic to known AI domains | Traffic that doesn't pass the proxy, such as off-network laptops without the client |
| Agent on the laptop (MDM or endpoint) | Installed AI apps, coding agents, local MCP servers | Browser-only use on personal devices |
This table is our summary. A vendor comparison by Nudge Security gives a similar map: network monitoring is "limited to corporate networks" and a browser extension "misses mobile and personal device usage" (Nudge Security, August 2026, low confidence because it is a vendor post).
Start with what you already have
Before buying anything, look at the reports included in your identity provider.
- Google Workspace. Security, then Access and data control, then API controls, then Manage App Access. It lists "Apps that have accessed Google data" and lets you mark each one Trusted, Limited or Blocked. New apps usually appear 24 to 48 hours after someone authorizes them (Google Workspace help). The OAuth log "records each time a third-party application is authorized" (Google Workspace help).
- Microsoft Entra. Enterprise apps, then All applications, which can now filter by Agent ID (Preview) (Microsoft Learn). By default, "all users are allowed to consent to applications" that don't need admin permissions. Microsoft recommends allowing user consent only for apps from verified publishers (Microsoft Learn).
Our view: this free view is the right first step for most companies. It shows the AI tools people connected to their work account. It does not show tools used with a personal account, or anything running on the laptop itself.
The tools, compared
| Tool | Main data sources | Finds AI agents or MCP servers | Public price |
|---|---|---|---|
| Nudge Security | Mailbox scan, OAuth grants, browser extension, SaaS APIs | Agents and MCP integrations via OAuth grants | Yes. Up to 150 users $750 per month, billed annually |
| Push Security | Browser extension | AI apps, personal accounts, agentic browsers | Yes. Up to 500 employees $5 per user per month, billed annually |
| Harmonic Security | Browser extension, endpoint agent, MCP gateway | Claude Desktop, Cursor and local MCP | No |
| Zluri | SSO, finance, browser extension, desktop agent | AI tools in 37+ categories | No |
| Torii | Identity provider, HR, MDM, finance, browser extension, OAuth | SaaS, AI and desktop apps; keys, tokens and agents | No |
| BetterCloud | OAuth, SSO, Chrome extension, expense data | Shadow AI inventory and agent governance, both released 2026 | No |
| Okta ISPM | Okta browser plugin in managed Chrome, integrations | Shadow AI agents, OAuth grants, MCP servers (endpoint inventory in Early Access) | Part of ISPM; add-on on Okta Essentials |
| Microsoft Defender for Cloud Apps | Firewall and proxy logs, Defender for Endpoint | Generative AI app category, alerts on new apps | Licensed with Microsoft 365 E5 or as an add-on |
| Netskope, Zscaler, Palo Alto AI Access Security | Inline network traffic (SSE) | Known generative AI apps; Zscaler inspects MCP traffic | No |
| Akamai (formerly LayerX) | Browser extension | AI use, personal accounts, extension risk | No |
| Jamf AI Governance for Mac | Jamf's agent on the Mac | AI tools, agents, local model runtimes, MCP server inventory | No |
| Noma Security | Your existing EDR or MDM | Agents, MCP servers and skills on endpoints | No |
| Prompt Security (SentinelOne) | Endpoint agent, browser extension, MCP gateway | Shadow AI in browsers, IDEs and terminals | No |
Sources are linked in the first column and listed at the bottom. All were checked on 15 October 2026. Nudge counts a "user" as a mailbox, which it says is typically 1.2 to 1.5 per employee (Nudge Security pricing).
The category is consolidating
Several AI security startups were bought in 2025 and 2026. SentinelOne closed its acquisition of Prompt Security in September 2025 (SentinelOne). Akamai completed its acquisition of LayerX on 2 July 2026 (Akamai). Proofpoint acquired Acuvity in February 2026 (Proofpoint). Productiv, a SaaS management vendor, shut down in August 2026 (Torii, medium confidence because Torii is a competitor).
Our view: ask any small vendor what happens to your data and contract if it is acquired.
What the EU expects
Article 4 of the EU AI Act, on AI literacy, has applied since 2 February 2025. After the Digital Omnibus amendment, it asks providers and deployers to "take measures to support the development of AI literacy". The European Commission's FAQ says staff using ChatGPT for work tasks are covered, and that an internal record of training is enough (European Commission, AI literacy Q&A, updated 27 July 2026).
The Dutch data protection authority has warned that staff entering personal data into an AI chatbot, against company agreements, can be a data breach that has to be reported (Autoriteit Persoonsgegevens, August 2024, medium confidence because we could only read it through search).
Our view: you can't train people on tools you don't know they use. Discovery comes first.
How to choose
Our view, not a sourced claim:
- Turn on the free reports in Google Workspace or Entra and read them monthly.
- Add a browser layer if personal-account use worries you. It is the cheapest way to see it on work laptops.
- Add an endpoint view if engineers use coding agents such as Claude Code or Cursor. Local MCP servers don't show up in OAuth logs.
- Use your SSE if you already pay for Netskope, Zscaler or Palo Alto. Don't buy one only for this at your size.
- Prefer tools that tell people what is approved. Blocking without an alternative sends use to personal phones.
Where Caspian fits
This section describes our own product. Caspian's free See plan lists every app and AI tool in use and who has access to each (Caspian pricing). It reads OAuth grants and authorization events from Google Workspace with read-only scopes, as described in our privacy policy, and reads apps and users from Microsoft Entra and Okta. On Macs running Caspian's agent, or managed through a connected MDM such as Fleet or Iru, it also sees which apps are installed.
Once IT approves a tool, Caspian's employee app store lists it for people to request, with what it is for and the company's rules for using it. Caspian is a young company: its ISO 27001 external audit is scheduled and its SOC 2 Type 2 observation window is running. It holds neither certification today.
Sources
| Source | Publisher | Date | Confidence |
|---|---|---|---|
| Work Trend Index 2024 | Microsoft and LinkedIn | 8 May 2024 | High |
| AI at work research | Salesforce | 15 Nov 2023 | High |
| 2026 AI Adoption and Risk Report | Cyberhaven | 5 Feb 2026 | High (vendor data) |
| Cost of a Data Breach 2025 | IBM | 30 Jul 2025 | High |
| GenAI blind spots | Gartner | 19 Nov 2025 | Medium |
| Detection methods compared | Nudge Security | 19 Aug 2026 | Low (vendor post) |
| Control which apps access Workspace data | Google Workspace help | Checked 15 Oct 2026 | High |
| OAuth log events | Google Workspace help | Checked 15 Oct 2026 | High |
| View applications | Microsoft Learn | Checked 15 Oct 2026 | High |
| Configure user consent | Microsoft Learn | 4 Aug 2026 | High |
| Manage generative AI apps | Microsoft Learn | 13 Oct 2026 | High |
| Pricing | Nudge Security | Checked 15 Oct 2026 | High |
| Pricing | Push Security | Checked 15 Oct 2026 | High |
| Harmonic Security | Harmonic Security | Checked 15 Oct 2026 | High |
| Shadow AI governance tools | Zluri | 18 Jun 2026 | High |
| Torii | Torii | Checked 15 Oct 2026 | High |
| Product updates | BetterCloud | Checked 15 Oct 2026 | High |
| ISPM AI agent discovery | Okta | 1 Sep 2026 | High |
| Securing generative AI | Netskope | Checked 15 Oct 2026 | Medium (marketing page) |
| AI access security | Zscaler | Checked 15 Oct 2026 | Medium (marketing page) |
| AI Access Security | Palo Alto Networks | Checked 15 Oct 2026 | Medium |
| Akamai completes LayerX acquisition | Akamai | 2 Jul 2026 | High |
| Jamf AI Governance | Jamf | 30 Jun 2026 | High |
| Endpoint agents | Noma Security | Checked 15 Oct 2026 | High |
| Prompt Security | SentinelOne | Checked 15 Oct 2026 | Medium |
| SentinelOne acquires Prompt Security | SentinelOne | Sep 2025 | High |
| Proofpoint acquires Acuvity | Proofpoint | 12 Feb 2026 | High |
| Why did Productiv shut down | Torii | 2026 | Medium (competitor) |
| AI literacy Q&A | European Commission | 27 Jul 2026 | High |
| Caution: AI chatbots and data breaches | Autoriteit Persoonsgegevens | Aug 2024 | Medium |
| Pricing and privacy policy | Caspian | Checked 15 Oct 2026 | High (our own pages) |
