Shadow AI at a single company is an IT problem. Across a portfolio it becomes a reporting problem. Each company has its own tools and its own level of IT maturity. Ask what “we don’t really use AI” means and you’ll hear a different answer at each one. The sponsor ends up with no comparable view of where portfolio data is going. The shadow AI risks are real. For an operating partner, the bigger gap can be that nobody answers the question the same way twice.
Shadow AI is any AI tool people use for work without the organization approving it: personal chatbot accounts, browser extensions, AI notetakers, and AI features switched on inside software the company already pays for. A ban on its own leaves the demand in place. What works is an inventory, a short policy, a sanctioned option people will choose, and a report that rolls up. That fits in 30 days if every company runs the same plan.
The shadow AI risks that matter to a sponsor
The shorthand version of shadow AI risks is “employees might paste confidential data into a chatbot.” That’s true, and it’s only the start. For a portfolio company, these are the exposures worth tracking.
Data leaves contractual control. When someone pastes customer data into a personal AI account, the consumer terms that person accepted govern it. The agreements the company negotiated with its own vendors don’t reach that account. A vendor’s consumer and business terms can treat retention and data use differently, so read the terms that apply to the account people are using.
OAuth grants outlive the person who clicked “Accept.” Some AI tools ask to connect to a mailbox, calendar or file store. In Microsoft Entra ID, users can consent to apps for permissions that don’t need admin approval unless you change that setting. Microsoft also notes that changing consent settings later doesn’t remove grants already in place. An AI app someone connected last year may still be reading that mailbox.
AI notetakers join calls nobody thought about. Board calls, lender calls and customer negotiations are exactly where a notetaker that one participant installed can capture and store content outside company systems. Recording consent rules vary by state, so ask counsel which rules apply.
Customer contracts may already say no. Customer agreements can carry confidentiality and data handling clauses. An employee summarizing a customer’s files in an unapproved tool can create a contract problem even if nothing leaks.
It shows up at exit. A buyer’s diligence team can reasonably ask which AI tools touch customer data and how they’re governed. Having that documented is far easier than rebuilding it under a deadline. It also helps to know where that customer data sits in the first place. Our DSPM vs CSPM comparison explains which tool answers that.
A 30-day shadow AI plan for every portfolio company
Run the same four weeks at every company, with the same outputs. The companies will finish at different levels of polish. That’s fine. Comparable beats perfect.
Days 1 to 7: Inventory
Week one produces a list. Decisions about each tool come later. Use what each company already owns.
- Network and endpoint discovery. Companies with Microsoft Defender for Cloud Apps can use cloud discovery to see which cloud apps are in use, review each app’s risk factors in the catalog, and see who’s using them. The Defender for Endpoint integration collects cloud traffic from Windows 10 and Windows 11 devices on and off the network. Companies without it can start from firewall, DNS or secure web gateway logs.
- App consent grants. Review enterprise applications in Microsoft Entra ID for AI tools that users have connected to mail, calendars or files.
- Browser extensions. If the company’s endpoint management tool reports installed browser extensions, pull that inventory. If it doesn’t, add an extensions question to the survey.
- A short survey. Ask people which AI tools they use and what for. Frame it as “help us pick the right tools.” If it reads like an audit, expect thin answers.
Days 8 to 14: Policy
Adopt one short, readable policy across the portfolio so no company has to write its own from scratch. Our AI acceptable use policy template gives you a draft to adapt. Whatever you use, it should answer three practical questions: which tools are approved, which kinds of data can go into them, and who to ask when something isn’t covered.
This is also the week to tighten app consent. Microsoft recommends allowing user consent only for apps from verified publishers, and Entra ID supports an admin consent workflow so people have a way to request an app they need. Revoke existing grants for AI apps the company won’t approve.
Days 15 to 21: Sanctioned tools
Shadow AI can be a sign of unmet demand. If the survey showed half the finance team summarizing spreadsheets in a personal chatbot, a policy alone won’t change that. Give people a sanctioned option that does the job, configured with the company’s identity and data controls. That could be Microsoft Copilot, Claude Team or Enterprise, or another enterprise tool the company can govern. If that’s Copilot, find and fix SharePoint oversharing first. Copilot can surface any file a user can already open.
Then deal with the high-risk leftovers. Defender for Cloud Apps lets you tag apps as unsanctioned and, where it’s integrated with Defender for Endpoint or a supported proxy, block them. Block selectively. Microsoft’s own guidance points out that people often use unsanctioned apps for legitimate work that the approved tools don’t cover, so talk to the users before you cut them off.
Days 22 to 30: Report up to the sponsor
Every company produces the same one-page summary:
- AI apps discovered, and which are approved, tolerated or blocked
- App consent grants reviewed and revoked
- Policy published and acknowledged
- The sanctioned tool and who has access
- Open exceptions, each with an owner
- Next quarter’s priorities
Mapping the summary to the four functions in the NIST AI Risk Management Framework (Govern, Map, Measure, Manage) gives the operating team and the board a shared vocabulary. Nobody has to invent a new one for each company.
What a shadow AI inventory can turn up: a hypothetical
Imagine a sponsor with six portfolio companies. In week one, discovery turns up three different AI notetakers and a dozen consumer chatbot accounts tied to work email addresses. It also finds an AI writing extension connected to a sales team’s mailboxes through an OAuth grant nobody remembers approving. Nothing there amounts to a breach, and every item traces back to the same gap: nobody owned the question.
By day 30, each company has one approved notetaker and the mailbox grant is revoked. A sanctioned AI tool is live for the teams that wanted one. The sponsor gets six one-page summaries in the same format. The operating partner can see which companies are behind and why.
That scenario is invented to show the shape of the work. It isn’t drawn from any client.
Where operating partners add the most value
Operating partners don’t need to run discovery themselves. Their value is consistency. Every company follows the same plan and reports in the same format, with a named owner at each one. The companies with thin IT teams will need help, and that’s where outside support earns its keep.
There’s a value creation angle too. A company that has moved people from scattered personal tools onto one governed AI tool is in a better position to use AI deliberately, and it has a cleaner story for the next buyer.
If you want an outside read on a single company before you roll the plan across the portfolio, the free AI Readiness Snapshot gives you one in a 60-minute working session.
Quick answers
What are the biggest shadow AI risks at a portfolio company?
Company and customer data going into personal AI accounts under consumer terms, OAuth grants that let AI apps keep reading mail and files, AI notetakers capturing sensitive calls, and conflicts with customer confidentiality clauses. For the sponsor, the added risk is having no consistent view across companies, which makes it hard to report or prepare for diligence.
Should portfolio companies just block ChatGPT and similar tools?
Blocking alone can push people to other tools or personal devices. A better approach is to publish a short policy, offer a sanctioned AI tool that does the job, and block only the high-risk apps that remain. Microsoft’s Defender for Cloud Apps guidance recommends understanding why people use an app before blocking it.
How long does it take to get a usable shadow AI inventory?
A first inventory can come together within the first week if the company already has endpoint or network tooling to pull from. It won’t be complete, and that’s acceptable. The point is a working list you can act on, then refine through monthly discovery reviews and the app consent review.
Who should own shadow AI at a portfolio company?
Day-to-day ownership belongs with the company’s IT or security lead, with a named executive accountable for the policy. The operating partner’s role is to set the common plan and reporting format across the portfolio and to make sure companies with thin IT teams get the support they need to finish.
Start with one company
The plan works best when it’s boring and repeatable. Run it at one company, fix what doesn’t fit, then roll it across the portfolio with the same template and the same report. Our shadow AI guide covers detection and policy in more depth.
To see where a portfolio company stands before you start, begin with the free AI Readiness Snapshot. If it turns up real gaps, our paid AI Readiness Assessment goes further.
Cocha Technology Inc. is a Houston-based AI governance and security advisory firm, serving organizations across the US, Canada and the EU.
