{"id":333,"date":"2026-09-09T19:25:18","date_gmt":"2026-09-09T23:25:18","guid":{"rendered":"https:\/\/securebydefault.io\/blog\/?p=333"},"modified":"2026-09-09T19:25:18","modified_gmt":"2026-09-09T23:25:18","slug":"shadow-ai-discovery-checklist","status":"publish","type":"post","link":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/","title":{"rendered":"A Shadow AI Discovery Checklist You Can Run This Week"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"536\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/09\/SBD_Blog_ShadowAI_Featured-1024x536.png\" alt=\"\" class=\"wp-image-335\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/09\/SBD_Blog_ShadowAI_Featured-1024x536.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/09\/SBD_Blog_ShadowAI_Featured-300x157.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/09\/SBD_Blog_ShadowAI_Featured-766x401.png 766w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/09\/SBD_Blog_ShadowAI_Featured.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In a recently published <a href=\"https:\/\/newsletter.securebydefault.io\/p\/shadow-ai\" data-type=\"link\" data-id=\"https:\/\/newsletter.securebydefault.io\/p\/shadow-ai\">newsletter<\/a>, I told the story of a government contractor in Australia who uploaded a spreadsheet full of flood relief applicants, names, addresses, and in some cases health information, to a personal ChatGPT account. Nobody approved it. Nobody reviewed it. By the time anyone found out, that data was already sitting on servers the organization had no control over.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That issue was about why this keeps happening. This post is about something more useful: how you actually find out whether something like that is already happening at your own company, right now, before it turns into a breach notification.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">No new software required. Just five things worth checking, most of which live inside tools you already pay for.<\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-1 wp-block-paragraph\"><strong>Why Most Companies Cannot Answer This<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Here is an uncomfortable question worth sitting with for a second. If someone asked you right now what AI tools your team actually uses, could you answer with any real confidence? Not the tools you rolled out. Not the ones in the employee handbook. The ones people are actually using to get their work done faster.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Most companies cannot answer that honestly, and the data backs it up. Microsoft&#8217;s own Work Trend Index found that the large majority of people using AI at work bring their own tools rather than anything their company approved or provided, and at small and medium sized businesses, that number climbs even higher. Cisco&#8217;s 2025 Cybersecurity Readiness Index, based on a survey of thousands of business leaders who actually hold security responsibilities, found that most companies do not know what their employees are asking AI tools, and most of them admit they would not even recognize unauthorized use if it were happening under their nose.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">None of that means your IT team is careless. It means you are in the majority, not some rare exception. The gap between the AI tools you approved and the AI tools people actually use is close to universal right now.<\/p>\n\n\n\n<style>\n.callout-cyan { background: #ECFEFF; border-left: 4px solid #0E7490; border-radius: 4px; padding: 14px 16px; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.6; color: #1f2937; margin-bottom: 20px; }\n.callout-cyan .callout-title { font-weight: 700; color: #0E7490; margin-bottom: 6px; }\n<\/style>\n\n<div class=\"callout-cyan\">\n  <div class=\"callout-title\"><\/div>\n This is also part of why the SecureByDefault 25-Point Security Checklist exists. Knowing what has access to your systems, including the access nobody granted on purpose, is one of the habits it is built around.\n<\/div>\n\n\n\n<div style=\"margin:36px 0;padding:22px 26px;background:#0D1E35;border-left:3px solid #00D4FF;border-radius:0 6px 6px 0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;\">\n  <p style=\"margin:0 0 14px;font-size:15px;line-height:1.6;color:#C5DCEC;\">\n    <strong style=\"color:#EEF5FF;\">Want the 25-point security checklist I actually use?<\/strong>\n    It&#8217;s the same baseline I run against real infrastructure &#8211; free, no fluff.\n  <\/p>\n  <a href=\"https:\/\/newsletter.securebydefault.io\" target=\"_blank\" rel=\"noopener\"\n     style=\"display:inline-block;background:#00D4FF;color:#050C18;text-decoration:none;\n     font-weight:600;font-size:14px;padding:12px 26px;border-radius:4px;letter-spacing:0.02em;\">\n    Get the Free Checklist &rarr;\n  <\/a>\n<\/div>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-2 wp-block-paragraph\"><strong>The Shadow AI Discovery Checklist<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Good news: fixing this does not start with a purchase. Most of what you need is already sitting inside tools your company already pays for. Here is the actual walk-through, in order.<\/p>\n\n\n\n<p class=\"has-cyan-bluish-gray-color has-text-color has-link-color wp-elements-3 wp-block-paragraph\"><strong>Step 1: Check Microsoft 365&#8217;s Enterprise Applications view.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your company runs on Microsoft 365, open Entra ID, the product formerly known as Azure AD, and look at Enterprise Applications. This view shows every third party app that has been granted access to company data through a user sign-in, and that list is almost always longer than admins expect. AI tools that connect through &#8220;sign in with Microsoft&#8221; show up here, alongside plenty of other apps nobody remembers approving.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What to actually look for: app names you do not recognize, permissions broader than the app seems to need (read access to email, files, or calendars is a common one), and how many users have granted that app access. One person connecting an unfamiliar tool is a quick conversation. Forty people connecting the same one is a pattern worth understanding.<\/p>\n\n\n\n<p class=\"has-cyan-bluish-gray-color has-text-color has-link-color wp-elements-4 wp-block-paragraph\"><strong>Step 2: Check Google Workspace&#8217;s API Controls.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your company runs on Google Workspace instead, the equivalent lives under Security, in API Controls. Same idea: a list of third party apps with OAuth access to company data, most of which were never formally reviewed by anyone. Work through it the same way you would the Microsoft view. Unfamiliar app, broad permissions, more users than expected.<\/p>\n\n\n\n<p class=\"has-cyan-bluish-gray-color has-text-color has-link-color wp-elements-5 wp-block-paragraph\"><strong>Step 3: Review browser extensions on company managed devices.<br><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the step most informal audits skip, and it is a mistake. A lot of AI tools never show up as a connected app at all. They show up as a browser extension, a small Chrome or Edge add-on that summarizes emails, rewrites text, or reads whatever page happens to be open. If you manage devices centrally, check installed extensions across your fleet. If you do not manage devices centrally yet, this is a decent argument for starting.<\/p>\n\n\n\n<p class=\"has-cyan-bluish-gray-color has-text-color has-link-color wp-elements-6 wp-block-paragraph\"><strong>Step 4:<\/strong> <strong>Ask, do not assume.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Technical scanning catches a lot, but it will not catch everything, especially personal accounts on personal devices being used for work tasks. The fastest way to close that gap is almost embarrassingly simple: ask people directly. A short, genuinely blame-free survey, something like &#8220;what AI tools do you use for work, no wrong answers here,&#8221; surfaces more real information than most technical audits manage on their own. People are far more willing to admit they used ChatGPT to draft an email before anyone has told them they were not supposed to.<\/p>\n\n\n\n<p class=\"has-cyan-bluish-gray-color has-text-color has-link-color wp-elements-7 wp-block-paragraph\"><strong>Step 5: Document what you find.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not react to each discovery the moment you find it. Build one simple list instead: tool name, who is using it, what data it can actually touch, and a category, approved, needs review, or block. You will likely end up with more entries than expected on the first pass. That is normal, and it is not a failure. The point of this step is not to fix everything today. It is to finally see the whole picture at once, instead of one surprise at a time.<\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-8 wp-block-paragraph\"><strong>What to Do With What You Find<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Finding ten unapproved apps does not mean ten apps need to be shut down by Friday. Treat this as triage, not incident response.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The real question for each tool is not &#8220;was this approved.&#8221; It is &#8220;what can this actually touch.&#8221; A tool with access to someone&#8217;s calendar availability is a very different risk than a tool with access to customer records or financial data, so sort by that first. Then sort by whether there is an actual legitimate business reason someone reached for it. A lot of shadow AI exists because someone found a real solution to a real problem, and the fix is often giving them an approved version of that same capability, not just taking the unapproved one away and calling it solved.<\/p>\n\n\n\n<p style=\"margin-bottom: 16px;\">\n  <strong style=\"color: #C0392B;\">Block now:<\/strong> Broad access to sensitive data, no clear business justification, or a vendor you cannot verify.\n<\/p>\n\n<p style=\"margin-bottom: 16px;\">\n  <strong style=\"color: #B8860B;\">Review this month:<\/strong> Moderate access, a real use case behind it, but no formal approval yet.\n<\/p>\n\n<p style=\"margin-bottom: 16px;\">\n  <strong style=\"color: #1E7A46;\">Leave alone for now:<\/strong> Limited access, low risk, and a tool that is clearly just helping someone do their job a little faster.\n<\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-9 wp-block-paragraph\"><strong>Turning This Into a Habit, Not a One-Time Check<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Here is the part that catches people off guard. This is not a project you finish once and cross off a list. New AI tools launch constantly, and a list of approved connections is only accurate for about as long as it takes one more person to sign up for the next one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Treat this checklist as a quarterly habit instead of a one-time audit. Put a recurring reminder on the calendar: fifteen minutes, four times a year, to run back through the same five steps. That is a small enough commitment that it will actually happen, and it is enough to keep shadow AI from quietly growing into something much bigger than it needed to be.<br><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-10 wp-block-paragraph\"><strong>Where to Go From Here<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">None of this requires a security team or a big budget. It requires about thirty minutes and an actual willingness to look.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you want the full story behind why this matters, the <a href=\"https:\/\/newsletter.securebydefault.io\/p\/shadow-ai\" data-type=\"link\" data-id=\"https:\/\/newsletter.securebydefault.io\/p\/shadow-ai\">newsletter <\/a>issue this post is based on walks through a real incident where a single unauthorized upload exposed personal information for thousands of people. Worth the ten minutes if you have not read it yet.<\/p>\n\n\n\n<div style=\"border-top: 2px solid #00D4FF; border-bottom: 2px solid #00D4FF; background-color: #EAF8FF; padding: 16px 20px; margin: 24px 0;\">\n  <p style=\"margin: 0; font-size: 15px; line-height: 1.6; color: #1A2B3C;\">\n    <strong>Want more practical security content like this?<\/strong>\n    <a href=\"https:\/\/newsletter.securebydefault.io\" style=\"color: #00A8CC; font-weight: 700; text-decoration: none;\" target=\"_blank\" rel=\"noopener\">Subscribe to The SecureByDefault Brief<\/a>\n    for one real attack, one practical fix, and one tool worth knowing, every week.\n  <\/p>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In a recently published newsletter, I told the story of a government contractor in Australia who uploaded a spreadsheet full [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[27,136],"tags":[28,138,142,140,141,139,143,137,29],"class_list":["post-333","post","type-post","status-publish","format-standard","hentry","category-ai-cybersecurity","category-small-business","tag-ai-security","tag-data-privacy","tag-entra-id","tag-google-workspace","tag-it-admin","tag-microsoft-365","tag-security-checklist","tag-shadow-ai","tag-small-business"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>A Shadow AI Discovery Checklist You Can Run This Week | SecureByDefault<\/title>\n<meta name=\"description\" content=\"A step-by-step checklist for finding the AI tools already connected to your business, using free settings inside Microsoft 365 and Google Workspace, built for small businesses and IT teams who cannot see their shadow AI exposure yet.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A Shadow AI Discovery Checklist You Can Run This Week | SecureByDefault\" \/>\n<meta property=\"og:description\" content=\"A step-by-step checklist for finding the AI tools already connected to your business, using free settings inside Microsoft 365 and Google Workspace, built for small businesses and IT teams who cannot see their shadow AI exposure yet.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/\" \/>\n<meta property=\"og:site_name\" content=\"SecureByDefault\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-09T23:25:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/09\/SBD_Blog_ShadowAI_Featured.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Ron Mercier\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ron Mercier\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/\"},\"author\":{\"name\":\"Ron Mercier\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\"},\"headline\":\"A Shadow AI Discovery Checklist You Can Run This Week\",\"datePublished\":\"2026-09-09T23:25:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/\"},\"wordCount\":1330,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\"},\"image\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/SBD_Blog_ShadowAI_Featured-1024x536.png\",\"keywords\":[\"AI Security\",\"Data Privacy\",\"Entra ID\",\"Google Workspace\",\"IT Admin\",\"Microsoft 365\",\"Security Checklist\",\"Shadow AI\",\"small business\"],\"articleSection\":[\"AI Cybersecurity\",\"Small Business\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/\",\"name\":\"A Shadow AI Discovery Checklist You Can Run This Week | SecureByDefault\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/SBD_Blog_ShadowAI_Featured-1024x536.png\",\"datePublished\":\"2026-09-09T23:25:18+00:00\",\"description\":\"A step-by-step checklist for finding the AI tools already connected to your business, using free settings inside Microsoft 365 and Google Workspace, built for small businesses and IT teams who cannot see their shadow AI exposure yet.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/#primaryimage\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/SBD_Blog_ShadowAI_Featured.png\",\"contentUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/SBD_Blog_ShadowAI_Featured.png\",\"width\":1200,\"height\":628},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/shadow-ai-discovery-checklist\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A Shadow AI Discovery Checklist You Can Run This Week\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/\",\"name\":\"SecureByDefault\",\"description\":\"Cloud Security &amp; Cybersecurity for IT Professionals\",\"publisher\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\",\"name\":\"Ron Mercier\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\",\"contentUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\",\"width\":512,\"height\":512,\"caption\":\"Ron Mercier\"},\"logo\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\"},\"sameAs\":[\"https:\\\/\\\/securebydefault.io\\\/blog\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/ron-mercier\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCDyWOTMI23S8Y3zwPoX3UkQ\"],\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/author\\\/sbd_admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"A Shadow AI Discovery Checklist You Can Run This Week | SecureByDefault","description":"A step-by-step checklist for finding the AI tools already connected to your business, using free settings inside Microsoft 365 and Google Workspace, built for small businesses and IT teams who cannot see their shadow AI exposure yet.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/","og_locale":"en_US","og_type":"article","og_title":"A Shadow AI Discovery Checklist You Can Run This Week | SecureByDefault","og_description":"A step-by-step checklist for finding the AI tools already connected to your business, using free settings inside Microsoft 365 and Google Workspace, built for small businesses and IT teams who cannot see their shadow AI exposure yet.","og_url":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/","og_site_name":"SecureByDefault","article_published_time":"2026-09-09T23:25:18+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/09\/SBD_Blog_ShadowAI_Featured.png","type":"image\/png"}],"author":"Ron Mercier","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ron Mercier","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/#article","isPartOf":{"@id":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/"},"author":{"name":"Ron Mercier","@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8"},"headline":"A Shadow AI Discovery Checklist You Can Run This Week","datePublished":"2026-09-09T23:25:18+00:00","mainEntityOfPage":{"@id":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/"},"wordCount":1330,"commentCount":0,"publisher":{"@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8"},"image":{"@id":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/#primaryimage"},"thumbnailUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/09\/SBD_Blog_ShadowAI_Featured-1024x536.png","keywords":["AI Security","Data Privacy","Entra ID","Google Workspace","IT Admin","Microsoft 365","Security Checklist","Shadow AI","small business"],"articleSection":["AI Cybersecurity","Small Business"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/","url":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/","name":"A Shadow AI Discovery Checklist You Can Run This Week | SecureByDefault","isPartOf":{"@id":"https:\/\/securebydefault.io\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/#primaryimage"},"image":{"@id":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/#primaryimage"},"thumbnailUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/09\/SBD_Blog_ShadowAI_Featured-1024x536.png","datePublished":"2026-09-09T23:25:18+00:00","description":"A step-by-step checklist for finding the AI tools already connected to your business, using free settings inside Microsoft 365 and Google Workspace, built for small businesses and IT teams who cannot see their shadow AI exposure yet.","breadcrumb":{"@id":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/#primaryimage","url":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/09\/SBD_Blog_ShadowAI_Featured.png","contentUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/09\/SBD_Blog_ShadowAI_Featured.png","width":1200,"height":628},{"@type":"BreadcrumbList","@id":"https:\/\/securebydefault.io\/blog\/shadow-ai-discovery-checklist\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/securebydefault.io\/blog\/"},{"@type":"ListItem","position":2,"name":"A Shadow AI Discovery Checklist You Can Run This Week"}]},{"@type":"WebSite","@id":"https:\/\/securebydefault.io\/blog\/#website","url":"https:\/\/securebydefault.io\/blog\/","name":"SecureByDefault","description":"Cloud Security &amp; Cybersecurity for IT Professionals","publisher":{"@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/securebydefault.io\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8","name":"Ron Mercier","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png","url":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png","contentUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png","width":512,"height":512,"caption":"Ron Mercier"},"logo":{"@id":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png"},"sameAs":["https:\/\/securebydefault.io\/blog","https:\/\/www.linkedin.com\/in\/ron-mercier\/","https:\/\/www.youtube.com\/channel\/UCDyWOTMI23S8Y3zwPoX3UkQ"],"url":"https:\/\/securebydefault.io\/blog\/author\/sbd_admin\/"}]}},"_links":{"self":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts\/333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/comments?post=333"}],"version-history":[{"count":4,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts\/333\/revisions"}],"predecessor-version":[{"id":338,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts\/333\/revisions\/338"}],"wp:attachment":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/media?parent=333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/categories?post=333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/tags?post=333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}