How do you find out which AI tools your employees use?

The short answer

Combine sources. None sees everything, and each covers the other’s blind spot: identity shows what was authorized with the company account, the network shows where traffic goes, the endpoint shows what runs on the device, even away from the office, and finance shows what someone paid for. Asking people helps you understand the reason, but it does not work as a method: a good share of use is not declared, not out of bad faith, but because nobody thinks they need to say so.

This guide describes each source, what it sees and what it lets through, and proposes a seven-day plan to reach a first real inventory. If you are still at “what is this?”, start with What is Shadow AI.

The five data sources, side by side

1. Identity: single sign-on and app permissions

The company’s identity provider records which apps were authorized to access the account, and by whom. It is the cheapest source, because the data already exists, and it finds one specific kind of use: the AI app that asked for access to email, calendar or files with the corporate login. It can also reveal high risk, because those permissions can be broad.

What slips through: anything the person uses with a personal account, and tools that do not ask for a login.

2. Network: DNS, proxy, firewall and SSE

Network records show which services the traffic went to, in what volume and at what times. It is the best source for sizing use and for finding tools nobody remembered to declare, without installing anything on the devices. Formats vary across next-generation firewalls, secure access service edge (SSE) services and event platforms (SIEM), and the real work is in turning addresses into tools: one product uses several domains, and one domain can host several products.

What slips through: remote work outside the VPN, personal devices and encrypted traffic where only the destination is visible. Attribution to the person is also usually weak.

3. Endpoint: an agent on the device

A lightweight agent installed on workstations records what was accessed and which application ran, on any network, and knows which device and which user were involved. It is the most complete source for the company’s fleet of computers, and the one that solves remote work.

What slips through: devices without the agent, such as personal phones and computers. And there is a decision that has to be made and communicated beforehand: what the agent collects. The difference between recording that a tool was used and capturing what was typed is large, and it is covered in the privacy section below.

4. Browser: an extension

An extension sees what happens inside the browser, which is where a large share of generative AI use takes place, and can get down to the detail of what is typed. That detail is exactly what makes it the most sensitive source: collecting content creates a new repository of sensitive data, with the risks that brings.

What slips through: desktop apps and browsers without the extension.

5. Finance: invoices and expense claims

Subscriptions to AI tools paid on an employee’s card and later reimbursed show up in expenses, and are the most direct clue to recurring, relevant use. The source costs almost nothing, because finance already has the data.

What slips through: all free use, which can be the largest share and the one with the least control.

What still slips through

• AI built into software already approved. Productivity suites, support platforms and editors have started offering AI features inside the same product. The original approval did not cover that, and the traffic leaves from the same domain as ever.
• Personal devices and accounts. No corporate source covers them fully; the answer is policy and training, not only technology.
• Code and API keys. Technical teams call models straight from code, with keys that go through no login. The source here is the repository and the cloud, not the network.
• Local models. A model running on the machine itself generates no outbound traffic. Only the agent sees it.

A seven-day plan

How to read the result

The first inventory tends to bring three groups: tools the company already knew about and approved, tools nobody knew were in use and that are harmless in practice, and a small group, with concentrated use, that deserves immediate attention. It serves less to find culprits and more to set priorities.

Two distinctions help. The first is between one-off and recurring use: a single visit to a site is not the same as a whole department depending on a tool. The second is the kind of data likely to go in: the same service carries different risks in marketing and in legal. To classify, our public catalog shows, per tool, the vendor, the country and the risk with the reason. The next step, handling each deviation, is in the guide on the risks of AI in the workplace.

The conversation with the people who use it

What people tell you after the survey is worth more than the survey itself. A few questions work well: what problem were you trying to solve?, what data did you put in? and what was missing from the approved tool? The tone matters. A conversation that opens with punishment can push use to where nobody can see it, and the company loses exactly the visibility it has just gained. Faced with real, frequent use, it is usually more productive to offer an approved alternative than to simply ban.

Discovering without becoming surveillance

In any design, inform people in advance, define the purpose in writing, limit collection to what is necessary and validate the arrangement with legal and the data protection officer, in light of the LGPD. Tangerin AI does discovery through an agent on workstations or through firewall, SSE and SIEM logs, and records which tool was used, when and on which workstation, without collecting the content of conversations, prompts or files. If you want to measure where your company stands before any project, the free assessment at /diagnostico asks nine questions, with no signup. If you are comparing vendors, see the ten criteria.

Frequently asked questions