20minutes
For IT Managers

Find out what AI tools employees use, with what you already own

No new vendor onboarding, no agents, no project code. You own the log console; that is the entire prerequisite. Twenty minutes from export to a per-user inventory, and the first pass is free.

Run the free audit The 4-step walkthrough
0 installsreads exports your stack already produces
10 sourcesUmbrella to Squid, plus any CSV with headers
Per userwhen your export carries the identity column
Freepreview with real totals before any spend
shadow-ai-audit.pdf Cover of the sample Shadow AI audit report prepared for an example company, with its headline findings. Sample report View all 11 pages Opens in your browser · PDF
The operator's timeline

Twenty minutes, honestly accounted

The practical end-to-end, from a console you know to a report you can forward. Each row is a step, each step has a time window.

MIN 0-8

Export from your console

30 days of allowed traffic from your DNS filter, proxy or firewall. Include the identity column if you want per-user attribution. This is the longest step, and the per-vendor guides pin the exact fields.

MIN 8-10

Register and upload

Email-only registration, drag the file onto the upload panel. The parser announces format, line count and detected columns before running.

MIN 10-13

Matching runs

Every hostname in the file is matched against 11,841 classified AI tool domains. The upload is discarded after processing. Free preview shows totals plus the top tools named.

MIN 13-20

Read and decide

Review the tiles, count the masked rows, screenshot for the ops channel. Decide whether the full $99 report is warranted. Most first runs answer that question themselves.

Your console's five minutes: Umbrella, Zscaler, Palo Alto, FortiGate, Cloudflare Gateway and five more, each with the export shape and sample lines.

What you get back

The report, read like an operator

Less "risk narrative", more "what do I do at the console". Here is the shape, with sample data.

Audit Report · Example Industries · 30-day DNS
AI ToolCategoryRiskUsersActionUsage
ChatGPTGeneral AssistantMedium87Sanction
GrammarlyWritingLow61Sanction
CopilotCode GenMedium34Review
DeepSeekGeneral AssistantHigh12Block
Otter.aiTranscriptionHigh9Block

The tool table, sorted twice

Once by risk for the block candidates, once by users for the procurement conversation. Both sorts come from the CSV.

The per-user table

Who reached what, with hit counts. Service accounts touching AI hosts are the sleeper finding: that is an integration someone built without a ticket.

The block-ready list

Abusive and block-verdict domains, exact hostnames including api. and cdn. subdomains, ready to paste into a custom category or blocklist.

The full report ships with a CSV for your own analysis and a PDF evidence pack. Import the CSV into your SIEM, SOAR or spreadsheet workflow.

Career math

Why this is the highest-leverage twenty minutes this quarter

Three situations where having the inventory already run changes your week. Each is a real conversation IT managers have reported.

When leadership asks

"What AI do we use?" lands on IT first, always.

  • Answering same-day with a dated PDF changes the meeting
  • Promising a project changes the budget conversation
  • The report is how operators get remembered at budget time

When something leaks

The moment a paste-into-chatbot incident surfaces, the first question is scope.

  • A standing inventory turns a panicked week into a targeted afternoon
  • You can name the tools and the users in the first meeting
  • Incident response needs facts, not estimates

When the renewal lands

Vendor consolidation talks go differently with data.

  • Four teams paying for overlapping AI tools out of expense budgets nobody compared
  • The audit names the overlap; you propose the consolidation
  • Cost avoidance that IT gets credit for

The escalation path starts here: the same report that serves you feeds the CISO's board slide. The CISO page shows where your twenty minutes end up in governance.

No-new-vendor math

What "no onboarding" actually saves

Compare the paths to your first real AI tool inventory.

PathTime to first dataProcurementDay-one coverage
Log auditToday, ~20 minNone for preview; $99 on a cardFull history of the logged network
Endpoint agentWeeks to monthsFull cycle, security review, pilotManaged devices only, from install day
CASB / SSE moduleA quarter, optimisticallyPlatform negotiationBrokered traffic, catalog-known apps
SurveyTwo weeks of chasingNoneWhat people admit remembering

The longer comparison, including when the heavier options genuinely win, is on the detection methods page. Start with the audit; buy the platform when you have findings to scope it.

Console workflow

From audit findings to configured blocks

The report gives you the list. Here is what the console work looks like after that.

1

Sort by risk and triage

Filter the CSV for high-risk and trains-by-default rows. These are the same-day blocks.

  • Abusive-purpose tools: block without discussion
  • Trains-by-default tools: block or escalate to legal
  • Everything else: review with department heads
2

Paste hostnames into your custom category

The block-ready list includes api. and cdn. subdomains. Copy into your DNS filter's custom deny list or firewall rule.

  • Exact hostnames, not wildcards that break other services
  • Cited reason per tool from the training-verdict column
  • Platform-specific guidance in the detection guides
3

Sanction the winners

Top tools by usage with low or managed risk go toward enterprise tiers and SSO.

  • Consolidate overlapping tools: 4 writing assistants become 1 sanctioned choice
  • Publish the sanctioned list with a request path for new tools
  • The sanctioned vs. unsanctioned page carries the framework
4

Re-run to verify

Same window next month or quarter. Blocked tools should show attempts only.

  • If allowed hits persist on a blocked tool, you found a bypass path for free
  • New tools surface that were not in the first baseline
  • The delta is the four-number report for whoever you report to
Accepted sources

Every log source the audit reads

No agent, no tap, no SSL inspection. Export from whatever you have.

DNS filters

Proxies and SWGs

  • Zscaler
  • Squid Proxy
  • Any CSV with a header row
  • Key=value syslog lines
  • One hostname or URL per line

Firewalls

Scope you can state in one line: hostnames, identities and timestamps only. No prompt content. Upload discarded after the run. Report deletable from the account at any time.

Flip through a real report before you upload anything

Ten pages of sample data: every tool with its verdict, the per-user breakdown, the block-ready list in an action plan. If it looks useful, your own version is twenty minutes away.

Open the sample PDF
Worked scenario

A 300-seat company in 22 minutes

Names and specifics are fictional; the workflow is real. This is what the first run looks like from the operator's seat.

Minutes 0 to 8: The export

IT manager opens the Umbrella console, navigates to Reporting, selects the last 30 days with all identities included.

  • Downloads a 4.2 MB CSV with 38,000 rows
  • Columns: timestamp, identity, action, hostname
  • The Umbrella guide has the exact click path

Minutes 8 to 13: Upload and match

Registers with a work email, drags the CSV onto the upload panel. The parser confirms: Umbrella format, 38,000 lines, 14 identity columns detected.

  • Free preview runs in under 2 minutes
  • Result: 31 AI tools found across 8 categories
  • Top 7 named, 24 withheld behind masked rows

Minutes 13 to 18: The preview read

Totals show 31 tools. Category breakdown: 9 general assistants, 6 writing, 4 code generation, 3 image, 3 transcription, 2 translation, 2 research, 2 other.

  • Risk flags: 4 high-risk, 8 medium, 19 low
  • Training flags: 6 train by default, 11 opt-out, 14 silent
  • The masked rows show enough to know the full report matters

Minutes 18 to 22: The decision

Screenshots the preview for the ops channel. The 4 high-risk tools and 6 trains-by-default tools are reason enough. Buys one $99 report. Full results in 3 minutes.

  • All 31 tools named with per-user counts
  • Service account hitting an AI code-gen API: surprise integration
  • The CSV is already open for block-list building
What is behind the match

The detection database your logs run against

Every hostname in the export is checked against a maintained, commercial-grade AI tool register. Here is what it covers.

11,841+ AI tool domains

Across 18 functional categories. Updated daily from a 120 million domain corpus, with roughly 300,000 new domains checked every day.

13,000+ vendor terms reviewed

Each tool carries a training-on-data verdict: does the vendor train on customer input, and when were the terms last checked? 700+ tools train by default.

3,900+ provider mappings

Which model provider actually powers each tool. OpenAI, Anthropic and Google are the most common. Useful for consolidation and contract reviews.

85.5% of AI tools say nothing about training in their public terms. That is not a guess; it is from reviewing the terms of every tool in the database. The report flags which of your tools fall in that silent category.

Compliance handoff

Where your report goes after the console work

IT runs the audit. Other teams use the output. Here is where each slice of the report lands and who acts on it.

Your CISO or security lead

Gets the four-metric slide: tools found, high-risk count, sanctioned share, quarter-over-quarter delta.

  • The same report you built becomes the board-pack input
  • See the CISO page for how they frame it

Legal and privacy

Gets the training-verdict table and data-sovereignty flags. They turn it into DPIA triggers and contract asks.

Department heads

Get their team's category rows, framed as consolidation offers. "Your team uses 4 writing tools; we can fund 1 properly."

  • Sanctioned-share growth is won here, not in the SOC
  • Position it as enabling, not policing

External auditors

Get the dated PDF evidence pack for the compliance binder. ISO 27001 surveillance, HIPAA risk assessment, or cyber insurance renewal.

  • "Quarterly log-based AI usage audit, reports on file" answers the row
  • The ISO 27001 page maps the evidence chain
Pricing for operators

What the budget line looks like

No platform fee, no per-seat charge, no contract. Reports are one-time purchases.

1 report: $99

One full audit. All tools named, per-user table, CSV, PDF. Good for a first run to see what the data looks like.

3 reports: $199

$66 each. Covers a baseline, a verification re-run, and one quarterly follow-up. Save 33% over single reports.

5 reports: $299

$60 each. A full year of quarterly audits with one spare. Save 40%. See pricing for the complete breakdown.

The free preview costs nothing and needs only an email. Most operators start there, see the withheld rows, and know within five minutes whether the full report is worth $99.

FAQ

IT manager questions

Do I need approval to run the free preview?

That is your call and your org's policy. Many operators treat it like any other log analysis: existing data, existing access, read-only output. The one-line scope statement usually settles it.

Which export should I start with?

Whichever console you can reach fastest. DNS filter logs are usually the one-click option. The walkthrough has the per-source cheat sheet.

What if my logs have no usernames?

You still get the full tool inventory with per-IP attribution. DHCP reservations make the IP table readable enough for most decisions.

Will this generate work I do not have time for?

It generates a short block list and a shorter procurement list. Both replace diffuse worry with an hour of defined console work.

How big can my export be?

Free: 5,000 lines or 2 MB. Full report: 2,000,000 lines or 25 MB. Larger environments handled on request via contact.

What does the paid report add?

Every tool named instead of a fifth, the per-user table, the sanctioned split, training verdicts and the CSV. The free audit page has the exact split.

You are one export away from knowing

The console is already open in another tab. Twenty minutes from now, the guessing is over.

Run the free audit