Short answer
Shadow AI is staff using AI tools like ChatGPT, Claude or Gemini without IT approval. Cloudflare shows which AI apps are used and by whom.
In detail: What Is Shadow AI and How to Find It
The risk is not the tools themselves but the data that goes into them. Customer records, contracts and source code pasted into an unapproved AI tool leave your control, and you have no log of what was shared.
How discovery works:
- Traffic from managed devices passes through Cloudflare's secure web gateway, which recognises AI applications.
- Each AI app is listed as approved, unapproved or under review, with usage trends per user and team.
- The results show where to start: which tools to approve, which to block and which data rules matter most.
Most organisations start with discovery for one team before they set any blocking policy, so nobody's work is interrupted on day one. A FirstNet AI security assessment covers this first step.