How should a CISO answer the board on shadow AI exposure?

With four metrics from a dated log-based inventory: AI tools found, high-risk and abusive counts, sanctioned share, and quarter-over-quarter deltas, presented in a repeating slide format.

How can a CISO get a shadow AI baseline quickly?

Export a month of DNS, proxy or firewall logs and run a free audit preview. Totals arrive in minutes, and a full report with every tool named costs $99 one time.

Does a shadow AI audit replace a CASB?

No, they compose. The CASB governs sanctioned SaaS while the audit sweeps the unclassified long tail and provides dated training verdicts, at a fraction of the cost.

Is hostname-level auditing employee surveillance?

It records which tools were reached, never prompt content. Publishing that scope and using findings for consolidation rather than discipline keeps trust intact.

What audit cadence works for board reporting?

Quarterly, with a constant export window and a constant slide format. The repetition is what turns individual reports into a governance trend.

What does a year of shadow AI evidence cost?

Four quarterly reports cost $299 as a 5-pack with one spare, or less through plan allowances, plus about twenty minutes of staff time per quarter.

Board Pack / Q3 2026

AI tools found: 37
high-risk: 5 ▼
sanctioned share: 64% ▲
training-exposed: 12 ▼
abusive: 0 ▬

For CISOs

"Are we exposed to shadow AI?" deserves a dated answer

The board will ask, if it has not already. The difference between a difficult meeting and a routine one is whether you answer with adjectives or with an inventory that carries a date. This page is the playbook for the second kind of meeting.

Get the baseline free The board-ready PDF

~20 minfrom log export to the first dated inventory

4 numberscarry the whole board narrative, quarter over quarter

11,841AI domains in the detection database

$0to see your first totals, before any budget ask

shadow-ai-audit.pdf

Cover of the sample Shadow AI audit report prepared for an example company, with its headline findings.

Sample report View all 11 pages Opens in your browser · PDF

The board translation

Turning the vague question into four metrics

"Are we exposed?" decomposes into four questions a report answers with numbers. Present these, and the conversation becomes governance instead of reassurance.

"How much AI is in use?"

Metric: tools found, total and per category. The first baseline usually lands 2 to 4 times above anyone's guess, which is why you run it before the board asks, not after.

"How much of it is dangerous?"

Metric: high-risk count, training-exposure count and the abusive-purpose flag. Zero abusive tools, with evidence, is a slide worth showing. Non-zero is a same-day action you report as handled.

"Is it under control?"

Metric: sanctioned share. The percentage of observed AI usage flowing through tools you contracted and listed. This is the number that trends, and trends are what boards govern by.

"Is it getting better?"

Metric: the deltas. New tools since last quarter, blocked tools showing attempts only, training verdicts that changed. Four consecutive reports make this a one-glance story.

Deck discipline: these four metrics, one slide, every quarter, same format. The annotated report tour maps each metric to the section it comes from.

Why logs, why now

The CISO's case for hostname evidence

You have vendors pitching agents, extensions and platforms for this. The log audit is the move that costs nothing to start and strengthens every later purchase.

It answers from history

The board's question is about the present and the past. Only log evidence answers retroactively.

Every deployed sensor starts from zero on install day
Logs cover the window that already happened
30 days of DNS history shows what surveys miss

It is procurement-neutral

A $99 report scoped by facts beats a platform bought on fear.

When you do buy depth later, the audit's findings write the requirements
The methods comparison is the vendor-meeting cheat sheet
No vendor lock-in, no contract, no recurring seat license

It survives scrutiny

Dated window, stated method, repeatable on demand.

The same properties your auditors want are the ones that make the board trust the trend line
PDF evidence pack carries the metadata external reviewers ask for
ISO 27001 and EU AI Act references on the compliance pages

Easy to defend internally: hostnames and identifiers only, no prompt content, uploads discarded after each run, reports deletable. The works council conversation is short.

What the report shows

The evidence layer your board slide sits on

Every number on your four-metric slide traces back to a row in this report. Here is the shape, with sample data.

Shadow AI Audit Report · Example Industries · 30-day DNS

AI Tool	Category	Risk	Users	Training
ChatGPT	General Assistant	Medium	87	Opt-out available
Grammarly	Writing	Low	61	Enterprise: no
Copilot	Code Generation	Medium	34	Enterprise tier: off
DeepSeek	General Assistant	High	12	Trains by default
Otter.ai	Transcription	High	9	Trains by default
Jasper	Marketing Copy	Medium	7	Opt-out available

Per-user breakdown

When the log carries user identifiers, the report shows which teams drive which tools. Target training and sanctioning conversations by department.

Training verdicts

Each tool carries a training-on-data verdict with the date the vendor's terms were last checked. 700+ tools train on customer data by default across the database.

Sanctioned split

If you provide an approved-tool list, the report scores usage against it. The sanctioned share percentage is the metric the board tracks quarter over quarter.

The full report includes a CSV export for your own analysis and a PDF evidence pack. The CSV integrates with SIEM, SOAR, or spreadsheet workflows your team already runs.

The first 30 days

From cold start to board-ready in four weeks

This is the standard cadence. Each week has a single deliverable and a single sentence you can now say to the board. The shape holds from 100 to several thousand seats.

Week 1: Run the baseline

Free preview on 30 days of DNS or proxy logs, then the full report at $99.

Export from whichever DNS filter, proxy or firewall you already run
Upload takes minutes; the report matches against 11,841+ AI tool domains
Board sentence: "We have a dated inventory. Here are the four numbers."

Week 2: Triage and block the urgent

Abusive-purpose tools blocked on sight. Triage meeting sorts the rest into sanction, control, block.

High-risk and trains-by-default rows are the immediate action items
Involve legal for tools flagged with data sovereignty concerns
Board sentence: "Immediate risks are closed. The plan for the rest is minuted."

Week 3: Sanction the legitimate

Top tools move toward enterprise tiers. Draft the sanctioned list with a request path for new tools.

Consolidate 4 writing tools into 1 sanctioned option
Publish the request process so employees stop going around you
Board sentence: "Legitimate demand is getting a legitimate outlet."

Week 4: Close the loop

Remaining blocks placed with published reasons. Schedule the next quarterly audit.

Configuration guidance per platform in the detection guides
The detect-before-you-block sequence underpins weeks 2 through 4
Board sentence: "The loop is standing. Next quarter you see the trend."

Stakeholder kit

One report, four audiences

The CISO's real job with the report is distribution. Each audience gets a different slice, and each slice drives a different action.

The board and CEO

The four-metric slide plus one sentence of interpretation. Attach nothing; offer the PDF to whoever asks.

Confidence comes from the format repeating every quarter
Lead with abusive-tools count, then sanctioned share
The trend line sells itself after Q2

Legal and privacy

The tool table with training verdicts and data sovereignty flags.

They turn it into DPIA priorities and contract asks
The GDPR evidence page shows their exact read
85.5% of AI tools say nothing about training in their terms

IT operations

The CSV export and the blocking configuration with cited reasons.

Their loop is configuration and the verification re-run
Per-platform guides carry the mechanics
The re-run proves the blocks took effect

Department heads

Their category rows and their team's usage, framed as consolidation offers.

Position it as enabling, not policing
Sanctioned-share growth is won here, not in the SOC
"Your team uses 4 writing tools; let us pick 1 and fund it properly"

Quarter-over-quarter

What the cadence looks like across a year

One report is a snapshot. Four reports are a governance narrative. Here is what each quarter adds to the story you tell the board.

Q1: Baseline

First full audit
Abusive tools blocked
Sanctioned list drafted
Board sees the raw numbers

Q2: First delta

New tools surfaced since Q1
Blocked tools show attempts only
Sanctioned share should climb
Board sees the slope

Q3: Steady state

Process is routine
New tools caught early
Training verdicts re-checked
Board sees the pattern hold

Q4: Year-end story

Four data points
Year-over-year comparison ready
Insurer evidence filed
Board sees governance, not a project

Four quarterly reports cost $299 as a 5-pack ($60 each, one spare). The whole year of evidence costs less than a single vendor lunch-and-learn. See pricing.

Hard questions

The pushback you will get, and the answers

Four objections CISOs hear when proposing the cadence, with responses that have worked.

"We already have a CASB / SSE."

Keep it; it governs sanctioned SaaS well. The audit sweeps the long tail your catalog has not classified and supplies dated training verdicts for vendor reviews.

They compose; the audit is the cheap half
CASB forward-looking, audit retroactive
The methods comparison is the vendor-meeting cheat sheet

"Won't this feel like surveillance?"

Hostname-level evidence reads which tools were reached, never what anyone typed.

Publish that scope internally
Use findings for coaching and consolidation, not discipline
Trust cost stays near zero when the method is transparent

"Where is the budget line?"

Free preview to scope. $99 per report, packs at $60 to $66 each, plans for monthly cadence.

One person, twenty minutes per quarter
No hardware, no agent, no network change
See pricing for the full pack breakdown

"What about false positives?"

The database is maintained daily and checked against 11,841+ confirmed AI tool domains.

Each entry is a verified AI tool, not a heuristic guess
13,000+ vendor terms reviewed for training verdicts
Roughly 300,000 new domains checked every day

Compliance interplay

Where the audit meets your existing frameworks

The same dated evidence that answers the board question also feeds compliance documentation you already maintain.

Framework	What the audit provides	Where it goes
ISO 27001	Dated AI tool inventory with risk classification	Annex A.8 asset register, surveillance audit evidence
EU AI Act	AI system enumeration with provider mapping	Article 4 AI literacy obligations, risk register
GDPR	Training verdicts and data sovereignty flags per tool	DPIA triggers, Article 30 processing register
HIPAA	AI tools accessing or processing ePHI indicators	Security risk assessment, BAA review queue
SOX / internal audit	Quarterly trend data on unsanctioned tool usage	IT general controls, change management evidence
Cyber insurance	"Quarterly log-based AI usage audit, reports on file"	Questionnaire row on AI usage controls

Each framework has a dedicated page on this site with the specific evidence chain. Start with EU AI Act or ISO 27001.

Accepted log sources

Works with the infrastructure you already run

No agent to deploy, no network tap, no SSL inspection. Export from whatever you have and upload the file.

DNS filters

Proxies and SWGs

Zscaler
Squid Proxy
Any CSV with a header row
Key=value syslog lines
One hostname or URL per line

Firewalls

Palo Alto Networks
Fortinet / FortiGate
SonicWall
Exports up to 25 MB / 2M lines
Larger networks: custom plan

FAQ

CISO questions

What do I show the board first?

The four-metric slide from your first full report: tools found, high-risk count, sanctioned share, and the actions already taken. Lead with the abusive-tools answer, because zero is a win and non-zero is a closed item.

How do I get a baseline without a project?

One log export from whatever you already run, uploaded to the free preview. Totals arrive in minutes. A full report with every tool named and risk-flagged costs $99 one time, no subscription.

What cadence do boards respond to?

Quarterly, same export window, same slide format. Consistency is what turns numbers into a governance narrative. Four data points make a trend; fewer are anecdotes.

How does this interact with our insurers?

Cyber questionnaires increasingly ask about AI usage controls. "Quarterly log-based audit, reports on file" answers the row. Attach the PDFs to the renewal application as evidence.

What if the first report looks bad?

First reports always look bad; that is why they exist. The board story is not the baseline, it is the slope you show next quarter. The improvement is the narrative.

Who runs it if my team is small?

One person, twenty minutes per quarter for the mechanics. MSPs also deliver it as a managed service if you outsource operations. The MSP page carries the economics.