How shadow AI detection tools work: four approaches and tradeoffs
Major shadow AI detection methods generally operate at four layers.
- Network monitoring
- Identity graph analysis
- SaaS Security Posture Management (SSPM)
- Browser-layer monitoring
While the above methods approach AI governance differently, they often overlap in areas such as SaaS visibility, app discovery, and access governance.
The main differences are deployment complexity and how each extends into data protection, compliance, and configuration management.
| Shadow AI detection method | Network layer monitoring | Identity graph analysis | SSPM/SaaS Security | Browser-layer monitoring + SaaS access controls |
|---|---|---|---|---|
| How it works | Analyzes traffic flowing through a proxy or secure web gateway (SWG) to uncover SaaS & AI usage patterns and data movement | Inspects identity relationships to determine which AI tools can access corporate data via OAuth grants, SaaS integrations, app permissions | Typically connects to SaaS apps & identity providers via APIs to continuously assess configurations, permissions, security posture | Detects and governs SaaS & AI access in the browser and provides in-context warnings when sensitive info may be shared |
| Strengths | Visibility into traffic and SaaS destinations on managed devices | Visibility into OAuth permissions, third-party integrations, access relationships | Visibility into SaaS configurations and security posture | Visibility into SaaS & AI browser logins, personal email signups for work, risky interactions in the browser |
| Deployment | Often requires proxies, agents, gateways, TLS inspections | Requires integration with IdPs and other identity or SaaS data sources to map access relationships | Requires API or OAuth-based integrations with SaaS apps and, in many cases, IdPs to collect configuration, permission, and security posture data | Runs through the existing browser extension with no need for agents, proxies, gateways, or other infrastructure |
| Best fit | If you already run SASE infrastructure and want traffic inspection | If you have an IdP and need visibility into OAuth permissions & third-party integrations | If you need deep SaaS governance, cross-app policy enforcement & configuration management across a large SaaS portfolio | If your immediate priority is fast visibility into SaaS & AI usage and where identity-related risks exist without adding infrastructure |
Sources: NHIMG, Palo Alto, Tech Green Hub, CISA
If fast visibility into SaaS and AI usage is your immediate priority, LastPass surfaces that usage and gives you the controls to govern it.
What IT teams may ask when they're looking for shadow AI detection tools
"We're evaluating a dedicated SSPM. Why would a password manager be part of that conversation?"
It's a fair question. SSPMs like Reco or AppOmni are purpose-built for deep SaaS access governance.
They provide API-driven visibility into OAuth grants, third-party integrations, and SaaS configuration posture. If your security roadmap includes a full SSPM deployment, that may be the right direction.
The question is whether you need to wait for that to see which AI tools your employees are using today.
LastPass Business Max answers a complementary question: Which tools are being accessed (and by whom) in the browser? For organizations that want fast visibility without a complex deployment while an SSPM evaluation runs its course, LastPass is the optimal choice.
"An extension can't give us the coverage a network-layer tool would."
Correct, in some ways. A network-layer tool can see all outbound traffic on managed devices, and with TLS decryption configured, it can also inspect prompt and data exchanges.
What a network-layer tool typically doesn't see, though, are AI tools employees access via browsers, tools signed up for with personal emails, or tools embedded inside approved SaaS.
"We're worried about employee surveillance. What exactly does LastPass Business Max capture?"
LastPass Business Max captures login events, not activity.
It can’t see what employees type, submit, or do inside the tool. No keystrokes are logged, screenshots taken, or prompt content is captured.
Whether this counts as surveillance depends on how the term is being used. If surveillance means recording what employees do inside apps, Business Max doesn't do that.
If it means maintaining a record of which tools employees access through a work browser, then yes, that's a function of SaaS Monitoring. If you’re enforcing an AI acceptable use policy with LastPass, it’s important to inform employees about it.
Discover the data behind the shadow AI detection gap
See where your shadow AI risk is growing fastest and how organizations similar to yours are responding.
Why trust the findings? The LastPass 2026 State of AI and SaaS Security Report is based on:
- App usage data at 15,907 organizations
- The login habits of 450,784 users across 20,631 organizations
- Insights from 412 IT leaders on AI adoption, shadow AI, and SaaS governance trends
