Shadow AI Discovery

Last reviewed: October 9, 2026

Use Shadow AI Discovery in Briard's main navigation to find possible AI use in approved work sources. A finding is a lead for a person to review. It does not establish who used a tool, whether sensitive information was shared, or whether a policy was broken.

For individual computers, local models and multiple sites, use the Fleet inventory and coverage guide. It covers expected-device registers, approved local checks, source age, identity lookup and review tasks. Those expanded paths are separately enabled and off by default; this edition does not establish full real-provider, hosted customer-workflow or long-running fleet acceptance.

Connect a source

1. Open Shadow AI Discovery and select the correct Workplace under Connect the places AI can hide.
2. Choose the source area you want to check, then a service your organization uses. Use A different provider / I'm not sure to find another provider or copy a setup link for your administrator. This does not approve access.
3. Choose the check, account and region when requested. Review What access does this use? before continuing.
4. If Briard offers an already approved account, confirm it is the intended account for this workplace. Otherwise, use the displayed provider approval or administrator setup path.
5. Wait for a completed check and review the last-success time, checked scope and any limitations. Saving a source or granting access alone does not establish coverage.
6. Review the findings for that workplace. Follow the next suggested source only when its owner has approved it.

A workspace owner or administrator manages connections. Availability depends on platform activation, your plan, the provider's licensing and your organization's permissions. Not enabled yet, needs attention or an incomplete check means that area remains unchecked; it is not a clean result.

Choose what to check

Source area	What it can help establish
Work accounts	AI applications visible through approved work-account metadata
Network activity	Contact with recognized AI services in approved network records
Computers & installed apps	Recognized software or extensions on visible managed devices
Cloud AI services	AI resources in the selected cloud account, project and region
Code & developer tools	AI seats or dependencies exposed by the selected development service
AI spending	Recognized AI purchases in the approved spending records
Work email signals	Approved sender or service metadata, without reading messages
Business apps	Supported application registrations or settings visible to that service
AI agents & tools	Approved agent and tool inventory metadata
Browser & employee reports	Supported website notices or a person's declaration for review

The current connection catalog includes Microsoft 365, Google Workspace, Okta, Cloudflare Gateway, Jamf Pro, CrowdStrike, AWS, Azure, Google Cloud, GitHub, GitLab, Brex, Ramp, Slack, Salesforce and Zoom. Other sources use approved customer-side collection. The screen's available checks and their permission descriptions are authoritative for your workspace. A listed provider is not a claim that every account, product feature or region is supported or that your organization has connected it.

Browser Check and employee reports supplement managed sources. They do not establish organization-wide coverage. A purchased seat, installed application or registered integration does not by itself prove runtime use.

When enabled, Device and model inventory separates Reported devices, Check fleet coverage and Review discovered AI. Current reported applications/models update automatically from accepted source evidence; reviewed records in My AI tools retain their separate ownership, purpose and policy decisions. An empty device or app list does not establish that no AI exists.

Provider steps that may need an administrator

• Google Cloud: select the intended project and location. If Google reports missing billing or APIs, ask that project's administrator to resolve the displayed prerequisite and then retry. The required services are Cloud Resource Manager and Agent Platform (Vertex AI), identified as aiplatform.googleapis.com. The OAuth approval can include broader scopes than read-only; the approved identity must also have appropriately restricted IAM permissions. Approval alone does not enable billing or an API.
• Salesforce: use Install Salesforce app, open the supplied installation link for the intended production organization, then return to Continue to access and Approve access. Installation and access approval are separate steps. Use an administrator-approved integration identity with restricted permissions; the provider's api scope is broad. A missing installation link needs platform setup, not a guessed URL.
• Azure: the selected subscription and the identity's read-only RBAC permissions define the permitted resource inventory. The provider consent scope alone is not a read-only guarantee.
• Customer-side collectors: give the setup link to the responsible administrator. Complete the displayed readiness and installation steps before claiming a successful check. A downloaded package does not prove installation or collection.

Enter a credential only in a dedicated connection field when that approved setup path explicitly requires it. Never put credentials in findings, employee reports, evidence uploads, email or support messages. Prefer the guided provider approval or workload identity path where available.

Review one finding

Open the finding's evidence and check its workplace, source, observation time, confidence and limitations. Choose Yes, this is ours, No, not ours, or I'm not sure. Uncertainty remains a review task and does not approve the tool.

After confirmation, an owner or administrator can select Add to AI inventory to create its governed record in My AI tools. Supply the owner, purpose and permitted data that source metadata cannot establish. Confirming a finding and adding a governed inventory record are separate actions. Neither automatically creates a Briard Alert & Response Console (BARC) case or authorizes additional collection.

Read coverage honestly

• A current completed receipt establishes only the displayed source, account, workplace and time window.
• Imported or previously saved evidence is not proof that a managed connection is active now.
• Partial, paused, failed and unconnected sources remain gaps.
• Device coverage needs an authoritative, complete and current expected-device set. Otherwise its percentage stays unknown. A reporting device or management roster alone cannot supply that assurance.
• A recent receipt or device heartbeat does not refresh an older or unknown software inventory date. Check each required capability, not just the connection's health.
• A completed empty check means no matching metadata was found within that check's scope. It does not mean no AI is in use.
• Separate accounts, regions and workplaces need their own applicable checks. One successful account does not cover the rest.

Pause, repair or remove access

Open the connection's status and use the available repair, retry, pause or removal action. Coordinate provider-side revocation with the source owner, especially when other checks reuse the same approval. Review those dependent checks afterward. Removing a connection stops future collection through that connection; it does not erase retained findings, decisions or evidence history.

For the Microsoft, Google Workspace and Browser Check setup paths, see Automation setup. For investigation event coverage, use BARC source connections; a Briard discovery finding does not by itself prove a BARC event feed.