You Can't Secure What You Can't See

Every CISO has lived the shadow IT era: unsanctioned apps spreading department by department, sensitive data flowing into tools nobody vetted. It took a decade to tame. Now it's happening again — faster, higher-stakes, and far harder to detect.

Shadow AI is the unsanctioned use of AI across your organization: developers piping proprietary code into a chatbot, analysts uploading financial models, marketers drafting strategy in whatever tab is open. None of it went through procurement. None was risk-assessed. And most security stacks have no idea it exists.

The trend is not subtle. Microsoft's Work Trend Index found that 78% of AI users bring their own tools to work — without company provision or approval. The question isn't whether shadow AI is happening. It's whether you have any visibility into it at all.

Why the usual tools miss it

Most enterprise security wasn't built for this threat model:

• CASB and SWG rely on known app signatures. The AI landscape is exploding — new providers weekly, new endpoints, models hosted on ephemeral infrastructure. No static catalog keeps pace.
• DLP inspects content but not AI-specific risk. It catches an SSN in an email attachment; it won't flag a proprietary algorithm pasted into an AI coding assistant for “optimization.”
• Network monitoring sees volume, not intent. A spike in HTTPS traffic to an AI API looks like any other API call — and a lot of usage runs through personal accounts that bypass SSO and logging entirely.

The result is a wide blind spot: the front door is secured while AI traffic flows through thousands of windows nobody knew were open. It isn't theoretical. In one widely reported case, engineers at a major manufacturer pasted source code and internal meeting notes into a public chatbot across three separate leaks in twenty days, and responded with a company-wide ban — because a blanket ban was the only tool they had. Several large firms followed. Bans were a blunt instrument for a visibility problem.

The discovery dilemma: visibility vs. disruption

Here's where most approaches go wrong. The instinct is to intercept everything — run all traffic through a TLS-terminating proxy and crack open every connection. It's what we do for web security, so why not AI?

Because it breaks things. Modern AI providers deploy aggressive bot detection — edge shields, TLS fingerprinting, certificate pinning. Try to decrypt a connection to a consumer AI site and you don't get inspection; you get an error and a frustrated employee who tethers to their phone to get around your stack entirely. You've traded a visibility problem for a visibility problem and a trust problem.

The fix is to separate discovery from enforcement. You don't need to decrypt a connection to know it's happening: the HTTPS CONNECT handshake and the DNS resolution both reveal the destination in plaintext, before any encryption. That's enough to answer the first question that matters — what AI is my organization actually using?

Two sensors, one picture

Effective discovery watches at two layers, each covering what the other misses:

• Network layer. When traffic flows through a forward proxy, the CONNECT request reveals the target hostname. Match it against a broad AI-provider catalogue — thousands of domains, not dozens — and you have real-time visibility. For providers you haven't approved, pass the traffic through without breaking TLS: no decryption, no certificate errors, no disruption. Just a quiet discovery event with the domain, timestamp, and source.
• Endpoint layer. Not all AI routes through the proxy — direct API calls and browser extensions slip past it. A lightweight endpoint agent watches DNS resolutions and the signals the network never sees: AI desktop apps in the process table, AI browser extensions, MCP configuration files, and locally hosted models that never phone home.

From discovery to a graduated response

Discovery is the foundation, not the destination. Once you can see usage, the real work begins — and the right model is graduated, not binary:

• Risk-tier automatically. An engineer on a reputable coding assistant is a different profile than someone uploading patient records to an unvetted startup. Score each provider on security posture, data-handling, and jurisdiction so the team focuses where it matters.
• Open a controlled path. The goal isn't to block all AI — that fight is already lost. It's to channel usage through approved, policy-governed paths.
• Enforce where you've approved. For sanctioned providers, turn on full inspection: redact PHI, PCI, PII, and secrets in prompts and uploads before they leave, and keep a reason on every finding. For everything else, stay in discovery mode while the team evaluates.

On the paths that guard data — an agent reaching for a tool, a call into a server you expose — BlueAspen fails closed. On the employee egress path it fails open by design: discovery and redaction should never be the reason someone can't get their work done.

What CISOs should be asking

Gartner predicts that by 2030, more than 40% of organizations will face security or compliance incidents from unauthorized AI use. The window is narrowing. Four questions worth putting to your team — and your vendors:

• How many AI providers can we detect today? Under 100 means you're blind to the long tail.
• Does discovery require TLS interception? If yes, you're trading visibility for disruption — and still missing traffic that bypasses the proxy.
• Can we see usage at the endpoint, not just the network edge? Remote work, split tunneling, and direct API calls all bypass network-only detection.
• Is enforcement graduated or binary? Block-everything and allow-everything are both losing strategies. You need a spectrum: discover, evaluate, govern, enforce.

Shadow AI isn't a future problem. It's a today problem, with a widening gap between what employees are doing and what security can see. Closing it starts with discovery — the kind that works quietly, across employees and agents, without breaking the tools people have already decided they need.