How to find and govern shadow AI

What is shadow AI, and why does it cost you money?

Most shadow AI is not malicious. An engineer expenses a Cursor seat, a team buys ChatGPT Team, and finance never maps the charge to a tool. The spend is real; the visibility is not.

The problem is measurement. Card statements show a vendor and a dollar amount. They do not show who uses the tool, whether the seat is active, or whether a sanctioned tool already covers the same job. That gap is what an audit closes.

How does Spendassay detect shadow AI?

OAuth and SSO grants reveal which AI apps employees have connected to corporate identity. Card and expense data reveal what is being paid for. A tool present in either, but absent from your sanctioned inventory, is flagged as shadow AI.

Every finding carries a proof level so you know how solid it is: Counted (from direct usage or spend data), Compared (against similar teams), or Estimated (from assumptions). Each finding also exposes the formula behind its dollar figure.

How do you govern shadow AI once you find it?

The audit does not write to, route, or throttle any vendor system. It finds the waste, sets the recoverable target, and gives your admins step-by-step instructions to act in their own tools. Routing and throttling are Control, a separate opt-in plan (private beta) that runs on your own provider keys.

For renewals, Spendassay builds a negotiation package. When a shadow tool is genuinely useful, the right move is often to sanction and consolidate it, not kill it. The audit gives you the dollar case either way.

What does an approved AI inventory look like afterward?

The audit treats findings at the team level, never as individual league tables. You govern by team and tool, not by naming employees.

Because detection runs on live SSO and card data, the next unsanctioned Cursor seat or ChatGPT charge shows up as a new finding. Governance becomes a standing process, not a one-time project.

Step by step

1. 1

   Connect a spend source

   Connect Ramp or upload a corporate-card CSV. This gives the audit the vendor charges that reveal paid AI tools no one has mapped. You can start with CSV import alone, with zero live integrations.

2. 2

   Connect an identity and usage source

   Connect Okta, Google Workspace, or GitHub for SSO and OAuth grants, and connect OpenAI or Anthropic for token usage. These signals show which AI apps employees have linked to corporate identity and how much they are used.

3. 3

   Review the shadow AI findings

   Open the findings list. Each shadow AI finding names the tool, the affected team, the dollar amount, and its proof level (counted, compared, or estimated). Expand any finding to see the formula behind the number.

4. 4

   Decide the path per finding

   For each finding choose to consolidate onto an approved tool, reclaim idle or duplicate seats, or formally sanction the tool. The audit sets the recoverable dollar target so the decision is grounded in spend, not opinion.

5. 5

   Act on the step-by-step instructions

   Spendassay generates a set of step-by-step instructions with the exact admin-console steps and the affected users. Your own admins execute it in the vendor system. The audit does not write to or throttle any vendor account.

6. 6

   Track the recovery

   As sources re-sync, Spendassay confirms closed findings and banks them into a Recovered statement. New shadow AI surfaces automatically as fresh grants and charges appear, keeping the inventory current.

Common questions