How to identify Shadow AI traffic: the signals we've found actually useful

Good breakdown – the embedded-AI problem (GitHub vs. Copilot) is exactly where domain lists fall apart. One layer I'd add below the network: the endpoint inventory itself. A lot of shadow AI never shows up as distinct traffic – local models (Ollama, LM Studio) run entirely on the machine, and AI browser extensions ride on normal browsing sessions. Checking installed apps, running local model servers and extensions gives you a baseline that network signals can then be correlated against.

Disclosure: I'm at OneSecure, and we built a free Windows app that does that endpoint inventory locally and tags each finding with an EU AI Act risk level: https://apps.microsoft.com/detail/9MWWCBH2L45C?cid=forum_mstc_traffic – curious whether you're correlating endpoint data with the traffic signals.