Module 5d — Shadow IT Discovery & AI Security Adoption

Goal: See every SaaS and AI app your people actually use, decide which are approved, and enforce that decision automatically — turning invisible "shadow IT" (and shadow AI) into governed, policy-controlled usage.

🧭 What is Shadow IT? The apps employees adopt without IT's approval — a personal Dropbox, an unsanctioned AI chatbot, a random file-converter site. You can't secure what you can't see. Shadow IT Discovery turns Gateway's traffic logs into a full inventory of the apps in use, so you can bring them under control. This is a key step in replacing your VPN: instead of implicitly trusting everything on the network, you make deliberate allow/block decisions per app.

The adoption journey (how this module flows)

  1 DISCOVER  →  2 REVIEW  →  3 ENFORCE  →  4 GOVERN AI
  see what's    approve /     act on the     apply the same
  actually      unapprove     status in       pattern to
  in use        each app      Gateway         AI apps + DLP

You'll do Discover → Review → Enforce for SaaS generally (Parts A–C), then apply the same muscle to AI security adoption (Part D).

Part A — Discover what's in use

1. 👉 In the dashboard, go to Insights → Analytics → Shadow IT Discovery (also surfaced via the Application Library).
2. 📺 What you'll see: the upgraded SaaS analytics dashboard — every application detected in your traffic, with:
   • who is using each app (users),
   • how much data is being transferred to it (volume),
   • the app's type/category (e.g. Artificial Intelligence, Social Media, Cloud Storage).
3. 👉 Filter by application type to focus a review — e.g. set the type to Artificial Intelligence to see all AI tools in use.

✅ Checkpoint: you can see a ranked list of apps with users and data volumes. (Little/no data? Confirm devices are in Gateway with WARP with TLS decryption — Module 5 — so HTTP traffic is logged.)

💡 Let it run. Give discovery a week or two of real traffic before making decisions, so your inventory reflects genuine usage patterns.

Part B — Review & set approval status

Every app can carry one of four approval statuses. This is your governance decision, recorded per app:

1. 👉 In Shadow IT Discovery (or Application Library → Review applications), open an application.
2. 👉 Set its approval status — e.g. mark your sanctioned suite Approved, mark a risky file-sharing site Unapproved, and set anything you're still assessing to In Review.
3. 👉 Work down the list by data volume / user count — the biggest usage first.

✅ Checkpoint: your most-used apps each have a deliberate status (not all "Unreviewed").

💡 Tip: involve app owners early. A "shadow" tool with heavy usage often signals a real unmet need — approving a secure equivalent beats a blunt block.

Part C — Enforce the decision with Gateway

Approval status becomes powerful when a Gateway HTTP policy acts on it — so decisions enforce themselves as new apps appear.

1. 👉 Gateway → Firewall Policies → HTTP → Add a policy.
2. 👉 Use the Application Approval Status selector (API: any(app.statuses[*] == "unapproved")).

Example policies:

3. 👉 Start the block policy in a monitor mindset — review Gateway logs for a few days to catch false positives — then enable enforcement.

✅ Checkpoint: browsing to an app you marked Unapproved shows the Cloudflare block page; an In Review app opens in an isolated remote browser; Approved apps work normally.

⭐ Self-maintaining governance: because the policy targets status rather than named apps, marking any future app "Unapproved" instantly blocks it — no policy edits needed.

Part D — AI security adoption

AI tools are the fastest-growing category of shadow IT — and the highest-stakes, because employees paste sensitive data into them. Apply the discover→review→enforce pattern specifically to AI, in five steps.

D1 — Define your AI risk tolerance (decide first)

Before configuring anything, align on strategy:

• Sanctioned vs. shadow AI: are you enabling approved AI tools, or mainly worried about unapproved ones? (Remember: approved SaaS vendors may have embedded AI features that also carry risk.)
• Data sensitivity: which data types must never enter an AI prompt? (Ties to your DLP work — Module 6.)
• Encourage or limit: do you want to promote safe AI use, or restrict it? This sets how permissive your policies are.

D2 — Discover shadow AI

👉 In Shadow IT Discovery, filter application type to Artificial Intelligence (Part A) — you now see exactly which AI tools (ChatGPT, Gemini, Claude, Perplexity, Copilot…) are used, by whom, and how heavily.

D3 — Review & approve AI apps

👉 Set approval statuses (Part B): Approve your sanctioned AI platform, mark others Unapproved or In Review.

D4 — Control AI usage (govern, don't just block)

👉 In Gateway HTTP policies, apply the AI acceptable-use approach from Module 7:

• Allow approved AI + guardrails — permit the app but block risky actions (file upload) via application granular controls.
• Block or isolate unapproved AI using the Application Approval Status selector (Part C).

D5 — Protect prompts with DLP

👉 Add AI prompt protection — DLP inspects what users type into AI tools and blocks sensitive content (PII, source code, secrets). See Module 7 Part C and Module 6 (DLP).

⭐ Best practice — don't hard-block AI outright. Blanket bans push people to personal devices where you have zero visibility. Discover → sanction a good option → guardrail it → protect prompts keeps AI productive and safe.

✅ Checkpoint: AI usage is visible by app and user; approved AI works with guardrails; unapproved AI is blocked/isolated; sensitive prompts are caught by DLP.

✅ Module 5d complete!

You now have:

• ✅ Full visibility into SaaS and AI apps in use (users + data volume)
• ✅ Deliberate approval statuses on your top apps
• ✅ Self-maintaining Gateway policies that act on status
• ✅ An AI security adoption path: risk tolerance → discover → review → control → protect

How this connects

Quick troubleshooting

👉 Next: Module 6 — DLP

Detect and stop sensitive data from leaving — including into the AI apps you just discovered.