Guides

What is shadow AI, and how do you actually find it?

Shadow AI is every LLM call your teams make that nobody logged: a developer points a coding agent or script at a provider in minutes and no record exists. Why dashboards can't see it, and how to go looking.

Shadow AI is the ad-hoc LLM usage nobody wrote down: a developer points a coding agent, a script, or an internal tool straight at a model provider, it works, and from that moment your organization has AI activity with no record, no screening, and no owner. It is not malice, it is friction: wiring a provider key into a tool takes four minutes, and telling anyone about it takes a meeting.

Why your dashboard can't see it

Every observability product shares one structural blind spot: it sees the traffic that goes through it. A call that goes around your gateway, straight from a laptop or a forgotten service to a provider's API, is invisible to any dashboard by definition. This is why "we have AI monitoring" and "we know where our AI calls are" are different claims, and why the second one is the one a review actually tests. The scale of the problem is growing fast: the vibe-coding wave means millions of new apps built by people who have never heard of prompt injection, calling LLM APIs directly.

How to actually find it

1. Scan the code. Ungoverned calls leave fingerprints in repositories: provider base URLs (api.openai.com, *.openai.azure.com, openrouter.ai, localhost model servers), API-key environment variables, SDK configuration blocks. A dependency-free scanner that walks a repo and flags every model endpoint that is not your governed gateway finds most of it in seconds. This is exactly what our shadow-AI scan does, and a sample-repo demo of it is on the financial-services page.
2. Check the egress. Provider domains appearing in firewall, proxy, or DNS logs from sources that are not your gateway are live shadow calls, not historical ones.
3. Make the governed path the easy path. Discovery without adoption is a quarterly ritual. The durable fix is a governed endpoint that is genuinely less work than going direct: one base URL, existing SDKs unchanged, keys issued centrally.

Honest limits

Scanning finds what's in the code you scan; egress review finds what's on networks you control. Neither proves coverage across a whole estate, and no product today honestly can. Proving that nothing went around the gateway, coverage as evidence rather than as hope, is what we are building with design partners now, and we would rather tell you that plainly than imply it ships today. What ships today: every call routed through RemKey is screened, attributed, and signed onto a tamper-evident chain from the first request. Start with the calls you can see; make the trail they land on one you can prove.