Do You Have a Shadow AI Problem? Here’s How to Find Out in 30 Minutes.

Your employees are using AI. The question isn’t if. It’s how much, which tools, and what data are they sharing?

Research shows that roughly 1.6% of all AI prompts contain sensitive enterprise data: credentials, PII, internal strategy, proprietary code. In a 1,000-person organization, that can translate to over 160 potential data exposures every single day.

And here’s the part that keeps CISOs up at night: most security teams have zero visibility into which AI tools their workforce is actually using.

This is the Shadow AI problem.

What Is Shadow AI?

Shadow AI is any AI tool used by employees outside official IT oversight. Think of it as the next evolution of Shadow IT, but with significantly higher stakes.

An employee pastes a customer contract into ChatGPT for summarization. A developer feeds proprietary source code into Cursor or Copilot. Someone in finance runs a P&L through Claude for analysis. None of these interactions are logged, monitored, or governed by your security stack.

Every one of them is a potential data leak.

A Simple Way to Measure Your Exposure

If you’re a SentinelOne customer running the Singularity Platform with AI SIEM, you can build a Shadow AI Discovery Dashboard in about 30 minutes using telemetry your EDR agents are already collecting. No additional agents, no new integrations, no extra licensing.

The dashboard leverages two data sources that SentinelOne agents natively collect:

• URL events to track which AI websites employees are visiting
• Process Creation events to identify AI desktop applications being launched

Here’s how to build it.

Step 1: Create the Dashboard

1. In the Singularity Operations Center, navigate to Dashboards > Custom Dashboards.
2. Click New Dashboard.
3. Name it something like AI Usage Monitoring and click Create.

Step 2: Add Six Panels

For each panel below, click the + button on your dashboard, select Pie/Donut Chart, and paste the corresponding query. Set each panel to Pie style, 10 max slices, and Percentage labels.

Panel 1: AI Desktop Apps (All OS)

See which AI desktop applications are being launched across your entire fleet.

| filter( event.type == "Process Creation" AND tgt.process.name in:anycase( "ChatGPT.exe", "Claude.exe", "Perplexity.exe", "Copilot.exe", "ms-copilot.exe", "Cursor.exe", "Windsurf.exe", "LM Studio.exe", "Jan.exe", "ollama.exe", "anythingllm.exe", "flowise.exe", "tabby.exe", "brave.exe", "notion.exe", "obsidian.exe", "vscode.exe" ) )
| group ProcessCount = count() by tgt.process.name
| sort - ProcessCount
| limit 1000 

Panel 2: AI Desktop Apps (Windows)

Break down AI app usage specifically on Windows endpoints.

| filter( event.type == "Process Creation" AND endpoint.os == "windows" AND tgt.process.name in:anycase( "ChatGPT.exe", "Claude.exe", "Perplexity.exe", "Copilot.exe", "ms-copilot.exe", "Cursor.exe", "Windsurf.exe", "LM Studio.exe", "Jan.exe", "ollama.exe", "anythingllm.exe", "flowise.exe", "tabby.exe", "brave.exe", "notion.exe", "obsidian.exe", "vscode.exe" ) )
| group ProcessCount = count() by tgt.process.name
| sort - ProcessCount
| limit 1000 

Panel 3: AI Desktop Apps (macOS)

Same view for macOS. Note that macOS process names don’t include the .exe extension.

| filter( event.type == "Process Creation" AND endpoint.os == "osx" AND tgt.process.name in:anycase( "ChatGPT", "Claude", "Perplexity", "Copilot", "Cursor", "Windsurf", "LM Studio", "Jan", "ollama", "anythingllm", "flowise", "tabby", "brave", "notion", "obsidian", "vscode" ) )
| group ProcessCount = count() by tgt.process.name
| sort - ProcessCount
| limit 1000 

Panel 4: Top AI Users

Identify which users are generating the most AI web traffic. This is often the most eye-opening panel.

| filter( event.category == "url" AND url.address contains:anycase( "chatgpt.com", "openai.com", "claude.ai", "anthropic.com", "ai.google", "grok.com", "gemini.google", "midjourney.com", "copilot.microsoft", "perplexity.ai" ) )
| group URLCount = count() by src.process.user
| sort - URLCount
| limit 10 

Panel 5: Which Browsers Are Accessing AI Sites

Understand the browser landscape driving AI usage.

| filter( event.category == "url" AND url.address contains:anycase( "chatgpt.com", "openai.com", "claude.ai", "anthropic.com", "ai.google", "grok.com", "gemini.google", "midjourney.com", "copilot.microsoft", "perplexity.ai" ) )
| group URLCount = count() by src.process.name
| sort - URLCount
| limit 10 

Panel 6: Top AI Sites by Volume

See the most-visited AI services across your organization.

| filter( event.category == "url" AND url.address contains:anycase( "chatgpt.com", "openai.com", "claude.ai", "anthropic.com", "ai.google", "grok.com", "gemini.google", "midjourney.com", "copilot.microsoft", "perplexity.ai" ) )
| group URLCount = count() by url.address
| sort - URLCount
| limit 1000 

Step 3: Read the Results

Set the time range to 24 hours and let the data tell the story.

If you see pie chart slices populating, congratulations: you’ve just confirmed that AI is actively being used in your environment. Now ask yourself:

• Are these sanctioned tools?
• Do you have policies governing their use?
• Is sensitive data being shared in those interactions?
• Would you know if an employee pasted a customer database schema into one of these tools today?

What This Dashboard Can (and Can’t) Tell You

This dashboard gives you visibility: who is using AI, which tools, how often, and from which endpoints. That alone is a massive step forward for most organizations.

But it can’t tell you:

• What data is being shared in those AI interactions
• Whether prompts contain PII, credentials, or proprietary code
• Whether employees are using unapproved AI tools beyond the ones listed here (there are thousands)
• Whether your custom AI applications are vulnerable to prompt injection or jailbreak attacks

That’s where a deeper assessment comes in.

The Next Step: A Prompt Security Assessment

If your dashboard reveals AI usage (and it almost certainly will), the natural follow-up question is: “How do I secure this without blocking productivity?”

Prompt Security from SentinelOne is purpose-built to answer that question. It deploys in minutes via a lightweight browser extension and gives you:

• Real-time shadow AI discovery across 15,000+ AI sites and tools
• Context-aware DLP that automatically redacts sensitive data from prompts before they reach external models
• Policy-based controls that let you enforce safe AI usage without blocking the tools entirely
• Prompt injection and jailbreak prevention for your custom AI applications
• Full audit logging capabilities for every AI interaction when compliance requires it

One customer discovered over 60 shadow AI tools within the first day of running a Prompt Security assessment. That’s 60 tools their existing security stack had no visibility into.

If you’re seeing AI activity on your dashboard and you want to understand what’s actually happening inside those interactions, reach out to your SentinelOne team or partner to schedule a Prompt Security Assessment. It’s the fastest way to go from “we have a shadow AI problem” to “we have a shadow AI solution.”

The Bottom Line

AI adoption isn’t slowing down. Your employees aren’t going to stop using ChatGPT, Claude, or Copilot because you asked them nicely. The organizations that win are the ones that give their workforce guardrails, not roadblocks.

Start with visibility. Build this dashboard. See what you find. And when you’re ready to take the next step, let’s talk about what Prompt Security can do for your organization.

The data is already there. The question is whether you’re looking at it.