Which AI tools is our team already paying for without telling us?
Employees signed up for AI tools on personal cards long before procurement had an opinion. Find them first, understand why people reached for them, then decide what stays.
Last reviewed:
Sound familiar?
- Finance sees recurring charges to AI tools nobody requisitioned through the normal process.
- Company data, including customer data, has likely already passed through tools that were never security reviewed.
- Banning tools outright without understanding why people adopted them just pushes the behaviour further underground.
- IT's visibility stops at company-issued devices and accounts — personal subscriptions used for work are invisible to them by design.
What we do
Discovery
A combination of expense review, browser and network signals, and honest conversations to surface tools already in use.
Risk triage
Each discovered tool assessed for what data it touches and what the actual exposure is, rather than treating every tool as equally dangerous.
Decide, don't just ban
For each tool: sanction it properly, replace it with an approved alternative, or shut it down — with a reason people understand.
Feedback loop into approval
The tools people were already reaching for become the first candidates in a working approval process, so the next one gets found faster.
Questions we get
Isn't this just a witch hunt against employees?
No — the goal is visibility and a functioning approval path, not punishment. Most shadow AI use exists because the approved alternative was slower or didn't exist.
What data are we actually worried about?
Anything pasted into a tool outside your control: customer data, source code, strategy documents, personal data covered by GDPR. We prioritise by what's actually gone through the tool, not by tool popularity.
How do we find tools that don't show up on expense reports?
Expense review catches the paid ones. Free-tier tools need browser and network-level signals or a direct, low-blame conversation with teams.
Tell us what's running in production.
We'll tell you what we'd check first — and what we wouldn't bother with.
Book a call