in one lineAI usage visibility is knowing which AI tools are in use, by whom, through what channels, and with what access to company data.
the numbers
- 75%of knowledge workers use AI at workMicrosoft & LinkedIn Work Trend Index, 2024
- 78%of people who use AI at work bring their own toolsMicrosoft & LinkedIn Work Trend Index, 2024
- 63%of organizations have no AI governance policyIBM Cost of a Data Breach, 2025
1what AI usage visibility means
AI usage visibility is the ability to answer, at any point in time, which AI tools are in use within your organization, by whom, through what channels, and with what access to company data.
It covers more than the tools your organization officially deployed. It includes personal AI accounts used for work, consumer-tier tools accessed through a browser, AI browser extensions installed on managed or unmanaged devices, and any AI connector app that received an OAuth grant from an employee.
Microsoft's 2024 Work Trend Index found that 75% of knowledge workers use AI at work, and that 78% of people who use AI at work bring their own tools rather than wait for an approved option. Visibility is what closes that gap. It is the data layer that makes policy enforceable and governance real, built for governance rather than for monitoring individuals.
2why AI tool usage is structurally hard to see
AI tools are harder to track than other software categories for reasons built into how they are distributed.
No procurement trail. Most AI tools offer a free consumer tier. There is no purchase order, no license agreement, no IT ticket. An employee starts using a tool with a personal email and your financial and procurement records have no trace of it.
Browser-first access. Many AI tools run entirely through a browser. There is nothing to install, nothing that registers in endpoint management, and no agent to deploy. The only footprint is in network traffic or in an OAuth grant if the user connected it to a work account.
OAuth grants made individually. When an employee connects an AI tool to their work email or documents, the grant is made with their credentials. It appears in your IdP, but most directories accumulate hundreds of these grants and no one is reviewing them on a regular cycle.
3what the visibility gap actually costs
Without visibility into AI usage, every other AI governance decision is made without the data it needs.
Policy cannot be enforced if there is no way to know which tools people are using. An acceptable use policy that lists approved tools does nothing about the unapproved ones if IT has no way to see them. The policy is a document. The tools keep running.
Data classification decisions made at the policy level do not translate to the data-flow level if the flows are invisible. The same data that your classification rules say should not leave the organization may be moving through a personal AI account that no rule can reach.
Audit and compliance responses become difficult. A regulator, auditor, or enterprise client asking about your AI governance needs a factual answer. If you do not know what tools are in use, you cannot give one.
what it looks like when it goes wrong
Three ways this tends to go, each one taken from a real case.
- it happenedSamsung, 2023howEngineers paste code and notes into a free chatbot to get help.what leavesconfidential code and meeting noteswho ends up with itan AI vendor on consumer terms
- it happenedDeepSeek exposed database, 2025howThe AI vendor leaves its own database open.what leaveseveryone's chats and the vendor's keyswho ends up with itanyone on the internet
- it happenedChatGPT shared links, 2025howA shared chat link becomes public with one checkbox.what leavesclient names and personal detailswho ends up with itanyone using a search engine
4what works
A reliable picture comes from layering sources, because each one sees what the others miss. The IdP's OAuth grant view is the richest single source: every AI tool an employee connected to a work account left a grant there, with scopes attached, and filtering that list for AI-related apps surfaces a large share of active use in an afternoon. DNS logs cover the next layer. Tools used purely through a browser create no grant and install nothing, but their domains appear in DNS filtering or monitoring records. Where endpoints are managed, the MDM's extension inventory adds the browser extensions, which often hold broader access than their users realized at install time.
The technical sources still miss the personal account used on a personal device, which is why the organizations with the most complete picture also simply ask. A short anonymous survey of which AI tools people use for work is often faster and more complete than discovery tooling, provided people trust that the goal is governance of data rather than scrutiny of individuals. The final move is the comparison: what is in use, set against what is approved. The gap between those two lists is the shadow AI surface, and it is the object every subsequent governance decision works on.
on the record
your turn
what you can do about it
this week
Pull the AI apps from your sign-in logs and expense reports for last month.
The list is usually longer than anyone guessed, and it is the starting point for every other decision.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →