Skip to main content
Shadow AI discovery shows which AI services people in your organization actually use, including the ones nobody approved. It reads a log source you already run, such as Cloudflare One, Netskope, CrowdStrike Falcon, or the Island Enterprise Browser, and matches the activity it finds against a catalog of known AI services. Discovery doesn’t need any of your traffic to go through Openlayer. It works from your existing logs, so it also covers people using AI tools directly in a browser.
Shadow AI discovery is turned on per deployment. If you don’t see Shadow AI → Discovery in the admin portal, reach out to us to turn it on.

​
How it works

1

Connect a log source

In the admin portal, go to Shadow AI → Discovery and click Connect. Pick a source from the Connectors dialog and enter its details. You can connect more than one. Each connector has its own setup guide.
2

Match activity to AI services

Openlayer matches the domains and app names in the source’s logs against its catalog of AI services. Activity that isn’t AI-related is ignored. When a source categorizes an app as AI but the catalog doesn’t know it yet, the app still appears, under the source’s name for it.
3

Review the findings

Each AI service becomes a finding, with its risk, how much it was used, who used it, and when. Mark each one Sanctioned or Unsanctioned.
4

Export what you want to block

Export the domains of your unsanctioned services in a format your enforcement tool accepts, such as a Cloudflare Gateway policy or a Zscaler URL category.

​
Connectors

The Connectors dialog lists the sources available on your deployment. CrowdStrike Falcon and Island are turned on separately from discovery. If you don’t see them, reach out to us. Connector secrets never go into the admin portal. Each one lives in an environment variable where Openlayer runs, and the portal stores only the variable’s name. Whoever runs your deployment sets the variable; if Openlayer hosts it for you, coordinate with us.

​
Findings

A finding is one AI service, such as ChatGPT or Claude, seen by one or more of your sources. The Discovery page summarizes them over the last hour, 6 hours, or 24 hours. When you connect more than one source, you can view them merged or one source at a time. Each source is counted in its own unit. Cloudflare counts DNS and HTTP requests, Netskope counts app events, CrowdStrike counts active hours, and Island counts browser navigations. None of these is a prompt count, and numbers in different units are never added together:
  • A finding’s headline number comes from its primary source, the one with the most activity in its own unit, and is labeled with that unit.
  • Seen by, in the finding’s details, lists every source’s own figure.
  • Users and last-seen times are merged across sources.
  • Devices and client tools, such as Claude Code or a browser, come from CrowdStrike.
  • Blocked attempts, from Netskope and Island, are shown separately and never count as usage.
Open a finding to see its activity, the sources that saw it, how the vendor handles data, the destinations observed, and who used it.

​
Risk

Each finding has a risk level: Critical, High, Medium, Low, or Unknown. It’s derived from facts about the service in the catalog, so equivalent services get the same rating and every rating can be explained:
  • whether the vendor trains on the data you submit by default
  • whether it offers an enterprise data-processing agreement (DPA)
  • where your data is processed
  • whether people typically use it with personal accounts, outside your SSO
  • how sensitive the data people send it usually is
Sensitivity only raises the risk when there’s a governance gap, such as no DPA, training on your data, or personal accounts. An enterprise tool with those controls in place isn’t penalized for seeing sensitive data. Heavy, recent use raises a rating by one level. That happens when the finding’s primary source counts at least 500 in the range you’re viewing (40 for CrowdStrike’s active hours), and the service was last seen within 6 hours of the range’s end. A rating is never raised past Critical, and the finding’s risk explanation says when it was raised. An AI app that isn’t in the catalog yet is rated Unknown until its facts are added. Use never raises an Unknown rating.

​
Review and export

New findings start as Needs review. Mark each one Sanctioned or Unsanctioned, and filter the list by status or risk to work through what’s left. A review decision doesn’t block anything by itself. To enforce it, click Export on the Discovery page and download your unsanctioned services’ domains as one of: The export is read-only. It produces a file and never changes your enforcement tool.

​
What’s stored

  • Cloudflare One is queried live each time you open Discovery. Openlayer stores only your review decisions for it.
  • The other sources can’t be queried again on each view, so Openlayer keeps counts of their AI activity for 30 days:
    • Netskope and Island: per-minute counts, plus the IDs of events already counted.
    • CrowdStrike: active hours, plus a cache of the processes it has looked up.
  • Raw log events, activity that isn’t AI-related, and page, prompt, or response content are never stored.
  • Disconnecting Netskope, CrowdStrike, or Island deletes the counts Openlayer stored for it.

​
FAQ

No. Discovery reads the logs your network or security tools already collect.
No. The sources report which services were reached, by whom, and how often. A count is an activity record, such as a DNS request or an app event, never a prompt.
No. It records your decision and adds the service to the export. Blocking happens in your enforcement tool, once you apply the exported list there.