---
title: "Do You Have a Shadow AI Problem? Here's How to Find Out in 30 Minutes."
description: "Discover the Shadow AI challenge: ensure your employees' AI usage stays secure and compliant with our practical dashboard guide."
author: "Pier-Luc Charbonneau"
date: 2026-03-14
lang: en
url: https://charbonneau.io/articles/do-you-have-a-shadow-ai-problem-heres-how-to-find-out-in-30-minutes/
topics: ["SentinelOne"]
---

# Do You Have a Shadow AI Problem? Here's How to Find Out in 30 Minutes.

Your employees are using AI. The question isn't _if_. It's _how much_, _which tools_, and _what data are they sharing?_

Research shows that roughly **1.6% of all AI prompts contain sensitive enterprise data**: credentials, PII, internal strategy, proprietary code. In a 1,000-person organization, that can translate to over **160 potential data exposures every single day**.

And here's the part that keeps CISOs up at night: most security teams have **zero visibility** into which AI tools their workforce is actually using.

This is the **Shadow AI** problem.

---

### What Is Shadow AI?

Shadow AI is any AI tool used by employees outside official IT oversight. Think of it as the next evolution of Shadow IT, but with significantly higher stakes.

An employee pastes a customer contract into ChatGPT for summarization. A developer feeds proprietary source code into Cursor or Copilot. Someone in finance runs a P&L through Claude for analysis. None of these interactions are logged, monitored, or governed by your security stack.

Every one of them is a potential data leak.

---

### A Simple Way to Measure Your Exposure

If you're a SentinelOne customer running the **Singularity Platform** with AI SIEM, you can build a **Shadow AI Discovery Dashboard** in about 30 minutes using telemetry your EDR agents are already collecting. No additional agents, no new integrations, no extra licensing.

The dashboard leverages two data sources that SentinelOne agents natively collect:

-   **URL events** to track which AI websites employees are visiting
-   **Process Creation events** to identify AI desktop applications being launched

Here's how to build it.

### Step 1: Create the Dashboard

1.  In the **Singularity Operations Center**, navigate to **Dashboards > Custom Dashboards**.
2.  Click **New Dashboard**.
3.  Name it something like **AI Usage Monitoring** and click **Create**.

### Step 2: Add Six Panels

For each panel below, click the **+** button on your dashboard, select **Pie/Donut Chart**, and paste the corresponding query. Set each panel to **Pie** style, **10 max slices**, and **Percentage** labels.

### Panel 1: AI Desktop Apps (All OS)

See which AI desktop applications are being launched across your entire fleet.

```
| filter( event.type == "Process Creation" AND tgt.process.name in:anycase( "ChatGPT.exe", "Claude.exe", "Perplexity.exe", "Copilot.exe", "ms-copilot.exe", "Cursor.exe", "Windsurf.exe", "LM Studio.exe", "Jan.exe", "ollama.exe", "anythingllm.exe", "flowise.exe", "tabby.exe", "brave.exe", "notion.exe", "obsidian.exe", "vscode.exe" ) )
| group ProcessCount = count() by tgt.process.name
| sort - ProcessCount
| limit 1000 
```

### Panel 2: AI Desktop Apps (Windows)

Break down AI app usage specifically on Windows endpoints.

```
| filter( event.type == "Process Creation" AND endpoint.os == "windows" AND tgt.process.name in:anycase( "ChatGPT.exe", "Claude.exe", "Perplexity.exe", "Copilot.exe", "ms-copilot.exe", "Cursor.exe", "Windsurf.exe", "LM Studio.exe", "Jan.exe", "ollama.exe", "anythingllm.exe", "flowise.exe", "tabby.exe", "brave.exe", "notion.exe", "obsidian.exe", "vscode.exe" ) )
| group ProcessCount = count() by tgt.process.name
| sort - ProcessCount
| limit 1000 
```

### Panel 3: AI Desktop Apps (macOS)

Same view for macOS. Note that macOS process names don't include the .exe extension.

```
| filter( event.type == "Process Creation" AND endpoint.os == "osx" AND tgt.process.name in:anycase( "ChatGPT", "Claude", "Perplexity", "Copilot", "Cursor", "Windsurf", "LM Studio", "Jan", "ollama", "anythingllm", "flowise", "tabby", "brave", "notion", "obsidian", "vscode" ) )
| group ProcessCount = count() by tgt.process.name
| sort - ProcessCount
| limit 1000 
```

### Panel 4: Top AI Users

Identify which users are generating the most AI web traffic. This is often the most eye-opening panel.

```
| filter( event.category == "url" AND url.address contains:anycase( "chatgpt.com", "openai.com", "claude.ai", "anthropic.com", "ai.google", "grok.com", "gemini.google", "midjourney.com", "copilot.microsoft", "perplexity.ai" ) )
| group URLCount = count() by src.process.user
| sort - URLCount
| limit 10 
```

### Panel 5: Which Browsers Are Accessing AI Sites

Understand the browser landscape driving AI usage.

```
| filter( event.category == "url" AND url.address contains:anycase( "chatgpt.com", "openai.com", "claude.ai", "anthropic.com", "ai.google", "grok.com", "gemini.google", "midjourney.com", "copilot.microsoft", "perplexity.ai" ) )
| group URLCount = count() by src.process.name
| sort - URLCount
| limit 10 
```

### Panel 6: Top AI Sites by Volume

See the most-visited AI services across your organization.

```
| filter( event.category == "url" AND url.address contains:anycase( "chatgpt.com", "openai.com", "claude.ai", "anthropic.com", "ai.google", "grok.com", "gemini.google", "midjourney.com", "copilot.microsoft", "perplexity.ai" ) )
| group URLCount = count() by url.address
| sort - URLCount
| limit 1000 
```

### Step 3: Read the Results

Set the time range to **24 hours** and let the data tell the story.

If you see pie chart slices populating, congratulations: you've just confirmed that AI is actively being used in your environment. Now ask yourself:

-   Are these **sanctioned** tools?
-   Do you have **policies** governing their use?
-   Is **sensitive data** being shared in those interactions?
-   Would you know if an employee pasted a **customer database schema** into one of these tools today?

---

### What This Dashboard Can (and Can't) Tell You

This dashboard gives you **visibility**: who is using AI, which tools, how often, and from which endpoints. That alone is a massive step forward for most organizations.

But it **can't** tell you:

-   **What data** is being shared in those AI interactions
-   Whether prompts contain **PII, credentials, or proprietary code**
-   Whether employees are using **unapproved AI tools** beyond the ones listed here (there are thousands)
-   Whether your custom AI applications are vulnerable to **prompt injection** or **jailbreak attacks**

That's where a deeper assessment comes in.

---

### The Next Step: A Prompt Security Assessment

If your dashboard reveals AI usage (and it almost certainly will), the natural follow-up question is: **"How do I secure this without blocking productivity?"**

**Prompt Security from SentinelOne** is purpose-built to answer that question. It deploys in minutes via a lightweight browser extension and gives you:

-   **Real-time shadow AI discovery** across 15,000+ AI sites and tools
-   **Context-aware DLP** that automatically redacts sensitive data from prompts before they reach external models
-   **Policy-based controls** that let you enforce safe AI usage without blocking the tools entirely
-   **Prompt injection and jailbreak prevention** for your custom AI applications
-   **Full audit logging capabilities** for every AI interaction when compliance requires it

One customer discovered **over 60 shadow AI tools within the first day** of running a Prompt Security assessment. That's 60 tools their existing security stack had no visibility into.

If you're seeing AI activity on your dashboard and you want to understand what's actually happening inside those interactions, **reach out to your SentinelOne team or partner to schedule a Prompt Security Assessment**. It's the fastest way to go from "we have a shadow AI problem" to "we have a shadow AI _solution_."

---

### The Bottom Line

AI adoption isn't slowing down. Your employees aren't going to stop using ChatGPT, Claude, or Copilot because you asked them nicely. The organizations that win are the ones that give their workforce **guardrails**, not **roadblocks**.

Start with visibility. Build this dashboard. See what you find. And when you're ready to take the next step, let's talk about what Prompt Security can do for your organization.

**The data is already there. The question is whether you're looking at it.**