Understanding How Shadow AI Detection Works
Use this topic when you want to understand how the Forcepoint Data Security Cloud Platform detects unsanctioned AI apps, where that data comes from, and why a particular app may or may not appear on your dashboard.
Sanctioned apps and unsanctioned apps are detected differently
The AI Landscape tab shows two different kinds of AI usage, and they reach the dashboard by two completely different routes.
| Sanctioned AI Apps | Unsanctioned AI Apps | |
|---|---|---|
| What it is | AI apps you have deliberately connected and approved. | AI apps employees use without approval, also called Shadow AI. |
| How data arrives | Through an app connector you configured — ChatGPT, Microsoft Copilot, or Claude. | Through your Forcepoint web security traffic. |
| What you set up | An app connector under Connector › App Connectors. | Nothing on the AI Security side — detection is automatic once web traffic flows through Forcepoint. |
| What you can see | Prompts, responses, files, and DLP violations. | Which app was used, how many users used it, and who they are. |
Where the data comes from
Unsanctioned AI app data is derived from your web security traffic. Every web request that passes through Forcepoint is recorded, and requests to known AI applications are identified and rolled up into the Unsanctioned AI Apps section of the dashboard.
You can see the underlying records yourself at any time. Go to Insights › Transaction Viewer and select the web collection. The Unsanctioned AI Apps section is a filtered, summarised view of the same web activity.
Why an app you expect may not appear
An app is identified using the Forcepoint AI application database, not URL categories. These are two separate classification systems, and this distinction is the most common source of confusion.
- URL categories classify websites. A site may be categorised as Generative AI and still not appear in the Unsanctioned AI Apps section.
- The AI application database classifies applications. Only apps present in this database are surfaced as unsanctioned AI apps.
If an AI tool your users are accessing does not appear in the Unsanctioned AI Apps section, the most likely reason is that it is not yet classified as an application in the AI application database.