{"id":8939,"date":"2026-09-17T18:45:54","date_gmt":"2026-09-17T13:15:54","guid":{"rendered":"https:\/\/newsdata.io\/blog\/?p=8939"},"modified":"2026-09-17T18:45:54","modified_gmt":"2026-09-17T13:15:54","slug":"find-shadow-ai","status":"publish","type":"post","link":"https:\/\/newsdata.io\/blog\/find-shadow-ai\/","title":{"rendered":"How to Find the Shadow AI and Untracked API Keys Already in Your Stack"},"content":{"rendered":"[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/4″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid” column_padding_type=”default” gradient_type=”default” offset=”vc_hidden-sm vc_hidden-xs”][\/vc_column][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” el_class=”text_block_wrapper” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”3\/4″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid” column_padding_type=”default” gradient_type=”default” offset=”vc_col-lg-9 vc_col-md-12″][image_with_animation image_url=”8940″ image_size=”full” animation_type=”entrance” animation=”None” animation_movement_type=”transform_y” hover_animation=”none” alignment=”” border_radius=”none” box_shadow=”none” image_loading=”default” max_width=”100%” max_width_mobile=”default”][vc_column_text]Somebody on your team created an API key eighteen months ago to test whether a news feed could drive a dashboard prototype. The prototype worked, so it shipped. The key still works, it’s still pulling data into something customers can see, and it isn’t written down anywhere, because at the time it wasn’t a system. It was an experiment.<\/p>\n

That’s the ordinary route to a problem that now shows up in breach data. IBM’s 2026 Cost of a Data Breach Report found that more than 20% of organizations reported breaches targeting AI models and applications<\/a>, and the entry points were mostly ordinary infrastructure. Compromised APIs, applications, and plug-ins accounted for 27% of those incidents, tied with cloud misconfigurations affecting AI workloads. The weak point sits in the plumbing around the model.<\/p>\n

A key is a credential and a data flow<\/h2>\n

An exposed credential is bad on its own, and the countermeasures are well understood. Scope the key narrowly, rotate it, keep it out of client-side code and out of the repo. All of that exists because a leaked key opens a direct path to unauthorized data access and system manipulation<\/a>, which is the failure everyone pictures when they think about key hygiene.<\/p>\n

The second thing a key represents gets less attention. Every key describes a route: this system talks to that system, pulls this category of data, and puts it somewhere. When the key is inventoried, you can reconstruct that route in an afternoon. When it isn’t, you’re doing archaeology under time pressure, usually while counsel asks whether customer records were involved and nobody can answer with confidence. IBM put the global average breach cost at $4.99 million in 2026, and detection and escalation costs make up a large share of that figure. Time spent working out what a system touched is time on the meter.<\/p>\n

Shadow AI has a maturity level, and it’s Level 1<\/h2>\n

This pattern is common enough to have a name and a position on a curve. ClickIT’s five levels of AI governance maturity<\/a> place informal adoption at Level 1, where teams create API keys independently, employees use consumer AI tools through personal accounts, and security or procurement learns about a tool only after it’s already in use. The diagnostic is blunt. If leadership can’t produce a reasonably complete list of the AI systems and tools currently running, that’s where the organization sits, regardless of how sophisticated the engineering looks from the inside.<\/p>\n

The next level up isn’t much comfort. A written acceptable-use policy and a tracking spreadsheet don’t change behavior on their own, and the defining risk becomes false confidence: the policy exists, so leadership feels covered, but nobody can name who approved the most recent AI system that reached production.<\/p>\n

Running the discovery pass<\/h2>\n

Most of what you need for a first inventory is data you already collect. Single sign-on logs show which third-party tools people actually authenticated into. Expense reports and card statements catch the subscriptions that never went near procurement, which is where a lot of small AI tooling lives. Egress logs and DNS records show what your infrastructure is talking to in production. A code search across repositories for key patterns and environment variable names turns up credentials nobody remembers committing.<\/p>\n

Vendor dashboards are the fastest source and the one teams forget. Most API providers will show you every key issued under your account and when each was last used, which surfaces both the forgotten prototype key and the one belonging to a contractor who left in 2024.<\/p>\n

The last source is people, and it works far better when nobody’s in trouble. An amnesty window, where anyone can register a tool they’ve been using without consequence, tends to surface more than a technical scan does, because a meaningful share of shadow AI never touches your network at all. It’s somebody pasting a customer list into a chat window on a personal laptop. A hard ban usually pushes that activity further out of view. If the unapproved tool was solving a real problem, removing it without offering a sanctioned equivalent just relocates the risk.<\/p>\n

Turning a list into controls<\/h2>\n

An inventory that ages out in a drawer is only slightly better than no inventory. Each entry needs a risk tier and a named owner, and the tiering should reflect what the system can reach rather than how impressive it is. A summarization tool reading public articles is not the same risk as an agent with write access to a customer database, even when they’re built on the same model.<\/p>\n

The NIST AI Risk Management Framework<\/a> organizes this work around four functions, Govern, Map, Measure, and Manage. The Map function is essentially the inventory exercise: establishing context for each system so that later risk decisions have something concrete to attach to. Skipping it is why so many governance programs stall. Teams buy a platform before deciding who owns the problem, and end up with one more tool to administer.<\/p>\n

Logging comes next, and it’s the control that pays off twice. Enterprise buyers and auditors want the same evidence you’d want during an incident. SOC 2 controls over API access<\/a> push organizations toward formal management of keys, service accounts, and authentication tokens, with permissions scoped by role and unnecessary privileges removed, rather than broad access granted by default. Build that once and the security questionnaire stops being a fire drill.<\/p>\n

Where governance stops and coverage starts<\/h2>\n

Good governance lowers the odds and shrinks the blast radius. It doesn’t take the risk to zero, and the costs of an incident arrive in a predictable order: forensic investigation, legal review, customer notification under state breach laws, credit monitoring for affected customers, and lost revenue while systems are offline. Cyber insurance covering breach response costs<\/a> is how most small companies absorb that sequence, and first-party coverage is the piece that handles damage to your own business.<\/p>\n

The underwriting process reads a good deal like a governance review. Insurers ask about access controls, multi-factor authentication, and how much sensitive data the business handles, and those answers shape both eligibility and premium. A company that can’t inventory its own AI systems will struggle to complete that application honestly, which is a practical reason to do the discovery work before you need the policy rather than after.<\/p>\n

One boundary is worth learning before you need it. Third-party coverage, often bundled with errors and omissions into technology E&O, is what responds when a client sues because they believe your product caused a breach at their company. If you sell software that touches customer data, that’s the scenario with your name on it, and it’s a different policy component from the one covering your own recovery.<\/p>\n

Start with the list<\/h2>\n

None of this requires a governance platform or a new headcount. It requires somebody to spend a week pulling SSO exports, expense data, and vendor key lists into one place, and a named person willing to own what comes back. The list will be longer than expected, and a few entries will be genuinely alarming. That’s the point. You can’t tier, monitor, revoke, or insure against systems you don’t know exist, and the forgotten prototype key is usually the one still running in production.[\/vc_column_text][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"

Somebody on your team created an API key eighteen months ago to test whether a news feed could drive a dashboard prototype<\/p>\n","protected":false},"author":11,"featured_media":8940,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[7],"tags":[],"yoast_head":"\nHow to Find the Shadow AI and Untracked API Keys Already in Your Stack - Newsdata.io - Stay Updated with the Latest News API Trends<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/newsdata.io\/blog\/find-shadow-ai\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Find the Shadow AI and Untracked API Keys Already in Your Stack - Newsdata.io - Stay Updated with the Latest News API Trends\" \/>\n<meta property=\"og:description\" content=\"Somebody on your team created an API key eighteen months ago to test whether a news feed could drive a dashboard prototype\" \/>\n<meta property=\"og:url\" content=\"https:\/\/newsdata.io\/blog\/find-shadow-ai\/\" \/>\n<meta property=\"og:site_name\" content=\"Newsdata.io - Stay Updated with the Latest News API Trends\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-17T13:15:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/newsdata.io\/blog\/wp-content\/uploads\/2026\/09\/shadow-ai-2026-08-27-06-49-56.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"668\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Raghav Sharma\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Raghav Sharma\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/newsdata.io\/blog\/find-shadow-ai\/\",\"url\":\"https:\/\/newsdata.io\/blog\/find-shadow-ai\/\",\"name\":\"How to Find the Shadow AI and Untracked API Keys Already in Your Stack - Newsdata.io - Stay Updated with the Latest News API Trends\",\"isPartOf\":{\"@id\":\"https:\/\/newsdata.io\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/newsdata.io\/blog\/find-shadow-ai\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/newsdata.io\/blog\/find-shadow-ai\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/i0.wp.com\/newsdata.io\/blog\/wp-content\/uploads\/2026\/09\/shadow-ai-2026-08-27-06-49-56.webp?fit=1200%2C668&ssl=1\",\"datePublished\":\"2026-09-17T13:15:54+00:00\",\"dateModified\":\"2026-09-17T13:15:54+00:00\",\"author\":{\"@id\":\"https:\/\/newsdata.io\/blog\/#\/schema\/person\/2c7fdfa00a8bc73559748ec23250f501\"},\"breadcrumb\":{\"@id\":\"https:\/\/newsdata.io\/blog\/find-shadow-ai\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/newsdata.io\/blog\/find-shadow-ai\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newsdata.io\/blog\/find-shadow-ai\/#primaryimage\",\"url\":\"https:\/\/i0.wp.com\/newsdata.io\/blog\/wp-content\/uploads\/2026\/09\/shadow-ai-2026-08-27-06-49-56.webp?fit=1200%2C668&ssl=1\",\"contentUrl\":\"https:\/\/i0.wp.com\/newsdata.io\/blog\/wp-content\/uploads\/2026\/09\/shadow-ai-2026-08-27-06-49-56.webp?fit=1200%2C668&ssl=1\",\"width\":1200,\"height\":668},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/newsdata.io\/blog\/find-shadow-ai\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/newsdata.io\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Find the Shadow AI and Untracked API Keys Already in Your Stack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/newsdata.io\/blog\/#website\",\"url\":\"https:\/\/newsdata.io\/blog\/\",\"name\":\"Newsdata.io - Stay Updated with the Latest News API Trends\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/newsdata.io\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/newsdata.io\/blog\/#\/schema\/person\/2c7fdfa00a8bc73559748ec23250f501\",\"name\":\"Raghav Sharma\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newsdata.io\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c64fa1d6e5c1d3bb3076c1db38e95026?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c64fa1d6e5c1d3bb3076c1db38e95026?s=96&d=mm&r=g\",\"caption\":\"Raghav Sharma\"},\"description\":\"Raghav Sharma is a content writer and media researcher at Newsdata.io, specializing in news industry analysis, media literacy, and the evolving landscape of digital journalism. With a background in English Literature and Journalism, along with a focus on fact-based reporting standards, Raghav covers topics including news API technology, editorial bias evaluation, and responsible information consumption. Raghav's work has covered media trends across categories, including healthcare news, international journalism, and API-driven publishing. You can connect with him on LinkedIn or explore more of his writing on the Newsdata.io blog.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/raghav-sharma-4981b4232\/\"],\"url\":\"https:\/\/newsdata.io\/blog\/author\/raghav\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Find the Shadow AI and Untracked API Keys Already in Your Stack - Newsdata.io - Stay Updated with the Latest News API Trends","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/newsdata.io\/blog\/find-shadow-ai\/","og_locale":"en_US","og_type":"article","og_title":"How to Find the Shadow AI and Untracked API Keys Already in Your Stack - Newsdata.io - Stay Updated with the Latest News API Trends","og_description":"Somebody on your team created an API key eighteen months ago to test whether a news feed could drive a dashboard prototype","og_url":"https:\/\/newsdata.io\/blog\/find-shadow-ai\/","og_site_name":"Newsdata.io - Stay Updated with the Latest News API Trends","article_published_time":"2026-09-17T13:15:54+00:00","og_image":[{"width":1200,"height":668,"url":"https:\/\/newsdata.io\/blog\/wp-content\/uploads\/2026\/09\/shadow-ai-2026-08-27-06-49-56.webp","type":"image\/webp"}],"author":"Raghav Sharma","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Raghav Sharma","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/newsdata.io\/blog\/find-shadow-ai\/","url":"https:\/\/newsdata.io\/blog\/find-shadow-ai\/","name":"How to Find the Shadow AI and Untracked API Keys Already in Your Stack - Newsdata.io - Stay Updated with the Latest News API Trends","isPartOf":{"@id":"https:\/\/newsdata.io\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/newsdata.io\/blog\/find-shadow-ai\/#primaryimage"},"image":{"@id":"https:\/\/newsdata.io\/blog\/find-shadow-ai\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/newsdata.io\/blog\/wp-content\/uploads\/2026\/09\/shadow-ai-2026-08-27-06-49-56.webp?fit=1200%2C668&ssl=1","datePublished":"2026-09-17T13:15:54+00:00","dateModified":"2026-09-17T13:15:54+00:00","author":{"@id":"https:\/\/newsdata.io\/blog\/#\/schema\/person\/2c7fdfa00a8bc73559748ec23250f501"},"breadcrumb":{"@id":"https:\/\/newsdata.io\/blog\/find-shadow-ai\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/newsdata.io\/blog\/find-shadow-ai\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newsdata.io\/blog\/find-shadow-ai\/#primaryimage","url":"https:\/\/i0.wp.com\/newsdata.io\/blog\/wp-content\/uploads\/2026\/09\/shadow-ai-2026-08-27-06-49-56.webp?fit=1200%2C668&ssl=1","contentUrl":"https:\/\/i0.wp.com\/newsdata.io\/blog\/wp-content\/uploads\/2026\/09\/shadow-ai-2026-08-27-06-49-56.webp?fit=1200%2C668&ssl=1","width":1200,"height":668},{"@type":"BreadcrumbList","@id":"https:\/\/newsdata.io\/blog\/find-shadow-ai\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/newsdata.io\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Find the Shadow AI and Untracked API Keys Already in Your Stack"}]},{"@type":"WebSite","@id":"https:\/\/newsdata.io\/blog\/#website","url":"https:\/\/newsdata.io\/blog\/","name":"Newsdata.io - Stay Updated with the Latest News API Trends","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/newsdata.io\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/newsdata.io\/blog\/#\/schema\/person\/2c7fdfa00a8bc73559748ec23250f501","name":"Raghav Sharma","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newsdata.io\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/c64fa1d6e5c1d3bb3076c1db38e95026?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c64fa1d6e5c1d3bb3076c1db38e95026?s=96&d=mm&r=g","caption":"Raghav Sharma"},"description":"Raghav Sharma is a content writer and media researcher at Newsdata.io, specializing in news industry analysis, media literacy, and the evolving landscape of digital journalism. With a background in English Literature and Journalism, along with a focus on fact-based reporting standards, Raghav covers topics including news API technology, editorial bias evaluation, and responsible information consumption. Raghav's work has covered media trends across categories, including healthcare news, international journalism, and API-driven publishing. You can connect with him on LinkedIn or explore more of his writing on the Newsdata.io blog.","sameAs":["https:\/\/www.linkedin.com\/in\/raghav-sharma-4981b4232\/"],"url":"https:\/\/newsdata.io\/blog\/author\/raghav\/"}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/newsdata.io\/blog\/wp-content\/uploads\/2026\/09\/shadow-ai-2026-08-27-06-49-56.webp?fit=1200%2C668&ssl=1","category":["General"],"featured_image_url":"https:\/\/i0.wp.com\/newsdata.io\/blog\/wp-content\/uploads\/2026\/09\/shadow-ai-2026-08-27-06-49-56.webp?fit=1200%2C668&ssl=1","_links":{"self":[{"href":"https:\/\/newsdata.io\/blog\/wp-json\/wp\/v2\/posts\/8939"}],"collection":[{"href":"https:\/\/newsdata.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsdata.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsdata.io\/blog\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/newsdata.io\/blog\/wp-json\/wp\/v2\/comments?post=8939"}],"version-history":[{"count":0,"href":"https:\/\/newsdata.io\/blog\/wp-json\/wp\/v2\/posts\/8939\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsdata.io\/blog\/wp-json\/wp\/v2\/media\/8940"}],"wp:attachment":[{"href":"https:\/\/newsdata.io\/blog\/wp-json\/wp\/v2\/media?parent=8939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsdata.io\/blog\/wp-json\/wp\/v2\/categories?post=8939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsdata.io\/blog\/wp-json\/wp\/v2\/tags?post=8939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}