Shadow AI surfaces the AI tools and services being used across your organization, including usage that would otherwise go unseen. As people adopt AI applications on their own, much of that activity happens without oversight. Shadow AI makes it visible, drawing on the activity from your connected SIEM to show which AI services are in use, who is using them, and how much data is moving through them.
The Overview page gives you the high-level picture of AI activity across your organization. The Events, Services, Users, and History pages break that activity down in detail.
How Shadow AI Classifies Activity
Detected AI activity is organized into a taxonomy with three levels: category, subcategory, and service.
At the top are four categories:
- AI Provider Access: Direct access to AI providers, such as calls to major LLM APIs and AI infrastructure providers.
- AI Enabled SAAS: Software-as-a-service applications that have AI capabilities built in, such as CRM and business platforms with AI features.
- AI Web App Usage: AI applications used through the browser, such as consumer AI tools and web-based assistants.
- Dev App Embedded AI: AI embedded in development tools and workflows, such as AI SDKs and coding assistants.
Each category contains subcategories that group related activity more narrowly, such as AI SDK Detection, API Keys Secrets, Collaboration Tools, and Major LLM APIs. Within each subcategory are the individual services detected, the specific AI tools and platforms that activity was attributed to.
Overview Page
The Overview page summarizes AI activity across the selected time range. A time range control at the top scopes the entire page, offering a relative window of the last 7, 30, or 90 days, or a custom date and time range.
Four metrics summarize activity over that range:
- Total Events: The total number of detected AI events.
- Unique Users: The number of distinct users associated with the activity.
- Data Transferred: The volume of data moved through the detected activity.
- Failed Requests: The number of requests that failed.
Activity Breakdown
A breakdown panel shows where AI activity is concentrated. you can view the breakdown by category, subcategory, or service, and filter by any combination of category subcategory, and service to narrow what it covers. A metric selector switches the breakdown between events, unique users, and data transferred, so you can see which categories, subcategories, or services account for the most activity by the measure you care about. The breakdown can be shown in several display formats.
Usage Over Time
A usage-over-time panel shows how AI activity has moved across the selected time range. You can group the trend by category, subcategory, or destination, adjust the interval, and switch between display formats to read the pattern the way that suits you.