Google Workspace
WSP-GOOG
- OAuth app grants
- Drive + Gmail scopes
- Admin audit signals
Shadow AI Discovery
Your employees are already using AI.
ShadowGuard shows you where.
Discover unapproved AI tools, identify sensitive data exposure, and give every department a safe path to use AI.
Read-only discoveryGoogle + MicrosoftBoard-ready proof
Live
· SCAN-0426 · chatgpt.com · mailbox.read· EVT-10291 · 2026-05-12 14:31 · browser-ext· POL-021 · internal-copilot · approved· SCAN-0421 · otter.ai · meeting.recorder· EVT-10288 · notion.so/upload · data.sensitive· WSP-M365 · entra.delegated · admin.read
Microsoft 365
WSP-M365
- Entra ID apps
- Delegated permissions
- Policy + directory
Why this matters
Your first AI governance problem isn't model risk. It's unmanaged access.
Most teams don't need a giant rollout on day one. They need to know which AI tools are connected, what those tools can access, who approved them, and what to fix first.
EVT-mailbox.read
AI tools with mailbox access
Employees can approve apps that read mail, calendars, files, or profile data before security ever sees the vendor.
EVT-oauth.broad
Risky OAuth grants
A normal-looking assistant can quietly receive broad delegated permissions across Workspace or Microsoft 365.
EVT-data.exfil
Sensitive files in unapproved tools
Customer data, contracts, source code, and internal docs can move into AI tools outside approved review paths.
EVT-policy.gap
No owner for AI usage
IT, security, legal, and operations all care, but nobody has a clear inventory or a prioritized fix list.
Product pillars
Discover. Score. Govern. Prove.
A command console for shadow AI risk — built for the buyer who needs a credible AI access report this week.
01
Discover
Find AI tools, coding assistants, agents, OAuth apps, and connected apps across Workspace and Microsoft 365.
02
Score
Rank risk by provider, user count, data scope, tool category, vendor posture, and policy status.
03
Govern
Mark tools approved, under review, or blocked. Give teams a clear policy trail instead of a spreadsheet.
04
Prove
Export a report leadership, clients, auditors, and cyber insurers can understand without a six-month platform rollout.
Inside the console
See the operations console behind the report.
ShadowGuard isn't a brochure. It's a command console for risk, evidence, and policy decisions — built for operators.
Risk Overview
shadowguard / dashboardAI tools01
47
Unapproved02
12
Sensitive findings03
9
Departments04
6
Recommended actionSeverityEvidence
Revoke ChatGPT Free for finance teamCritical
Approve internal Copilot with scoped accessApproved
Review Otter.ai meeting recorderReview
Block Notion AI on shared workspaceHigh
Evidence Vault
EVT-10291 · 2026-05-12 14:31 CST
Every finding ties back to a timestamped artifact: source system, tool domain, user context, and policy reference.
Approval Queue
3 pending · 1 escalated · POL-021
Approve, approve with controls, or deny — with one click and a complete policy trail.
Scan Review
WSP-GOOG + WSP-M365
Repeat scans surface OAuth grants and connected apps so new AI usage can move into review.
Where we win first
Built for teams the large governance platforms are too heavy to serve.
The first market isn't the Fortune 100 — it's the buyer who can't spend six figures to learn what AI tools their team is using.
MSPs
Run a repeatable Shadow AI scan across client tenants.
SOC 2 startups
Show AI usage governance before the auditor asks.
Law and accounting firms
Find client-data exposure through unreviewed AI apps.
Healthcare operators
Identify risky AI access before sensitive data leaves approved systems.
Assessment packages
Turn AI sprawl into a board-ready governance package.
For teams that need more than a scan, ShadowGuard packages inventory, risk review, controls, evidence gaps, and final reporting into a practical assessment workflow.
AI Governance Readiness Assessment
SMBs and lean operators using AI without a formal inventory.
A practical view of current AI use, ranked risk, missing controls, and the next actions leadership can approve.
- AI system inventory.
- Risk-ranked use case assessment.
- Governance controls checklist.
- Evidence gap summary.
- Leadership-ready report and roadmap.
Family Office AI Risk Review
Family offices and operators overseeing AI adoption across portfolio companies or operating entities.
A board-ready oversight view of where AI is being used, which use cases create exposure, and what proof is missing.
- Portfolio/company AI usage inventory.
- High-risk use case summary.
- Owner and department accountability map.
- Control and evidence gap review.
- Executive briefing pack.
Board/Client-Ready AI Governance Pack
Advisory, legal, accounting, healthcare, and security teams that need proof artifacts for clients or leadership.
A controlled governance deliverable that shows AI usage, readiness, evidence gaps, and remediation status.
- Finalized governance report snapshot.
- Client export pack.
- PDF deliverable.
- Secure delivery link.
- Review and remediation record for internal operators.
ShadowGuard assessment outputs support readiness review and governance evidence. They are not legal advice, certification, or a guarantee of compliance.
Trust model
Security buyers want to know what happens before they connect.
Provider authorization, scoped access, token protection, and honest compliance language.
TRUST-01
Read-only discovery
Discovery is designed to inspect authorization data without modifying the provider environment.
TRUST-02
Encrypted tokens
Provider tokens are encrypted and never appear in logs, audit events, or API responses.
TRUST-03
Compliance support
Built for teams working toward SOC 2, HIPAA-aware, GDPR-aware, NIST AI RMF, and ISO 42001.
Executive output
A plain-English risk report leadership actually reads.
Three pillars, one delivered artifact: a prioritized Shadow AI risk report you can hand to a CISO, an auditor, or a client.
Shadow AI Risk Report
What to fix this week
Executive summary
REP-01Plain-English overview of detected AI access, highest-risk grants, provider coverage, and priority actions.
Risk queue
REP-02Top findings ranked by severity, scope, user count, data type, and recommended review owner.
Remediation plan
REP-03Approve, review, block, revoke, document, or monitor. Each item has a recommended next step.
Evidence
REP-04Provider, app, scope, status, timestamp, and policy notes for internal review or audit prep.
Export formats
PDFCSVLeadership summaryAudit evidence
Validation sprint offerRun the free scan.
Run Shadow AI ScanRun the free scan.
See your Shadow AI exposure in minutes.
Use the report to decide what to approve, review, block, and document before AI usage turns into a client, compliance, or security problem.
FAQ
Questions buyers ask before the first scan.
Short answers for IT, security, and operators who need to understand the access model before connecting a provider.
- 01What is shadow AI?
- Shadow AI is any AI tool, assistant, browser extension, OAuth app, agent, or workflow that employees connect to company data without security review.
- 02What does the free scan check?
- The scan reviews Google Workspace and Microsoft 365 authorization data to surface AI-related apps, risky OAuth grants, exposed scopes, connected users, and recommended next actions.
- 03Do you support Microsoft 365?
- Yes. ShadowGuard supports Microsoft 365 and Entra ID alongside Google Workspace. Microsoft is treated as a first-class discovery source.
- 04Do you modify my Google or Microsoft environment?
- No. Discovery is designed around read-only provider access wherever possible. Enforcement actions are separate, explicit admin actions.
- 05Do you store prompt contents?
- ShadowGuard discovery does not read or store AI prompt contents. AgentGuard enforcement is designed to classify sensitive content and store policy outcomes rather than raw prompt text.
- 06Who is ShadowGuard built for first?
- ShadowGuard is built first for lean IT and security teams, MSPs, SOC 2-bound startups, law firms, accounting firms, healthcare operators, and other teams that need useful AI visibility without a large enterprise rollout.
- 07How fast can I get value?
- The goal is a useful first report in minutes: connect a provider, run discovery, review the top risks, and export a report you can discuss with leadership or clients.