Shadow AI Is a SaaS Problem First
Shadow AI is usually discussed as a security risk: confidential data pasted into a chatbot nobody approved. That risk is real. But in most organizations the first visible sign of unmanaged AI is not a breach. It is a line on an expense report, an API key in a developer's project, and the same assistant bought four times by four departments.
That makes shadow AI a SaaS management problem before it is anything else, and SaaS management already has the tools to find it.
The evidence
Three independent data sets point the same way:
- Zylo's 2026 SaaS Management Index, published on 29 January 2026 and based on more than 40 million SaaS licenses and $75 billion of spend under management, found spend on AI-native applications up 108% year over year, and up 393% in organizations with more than 10,000 employees. Expense-based SaaS spend rose 267%, which Zylo ties to AI tools bought on employee cards and expense reports outside procurement. ChatGPT is now the most expensed application. The same report puts the average share of unused SaaS licenses at 36%.
- Flexera's 2026 State of ITAM report, from a survey of 512 technology professionals published on 24 June 2026, found that only 31% have accurate visibility into AI software, that 59% say wasted AI spend increased year over year, and that complete IT asset visibility fell to 36%.
- The FinOps Foundation's State of FinOps 2026, from 1,192 respondents, found that 98% of respondents now manage AI spend, against 63% a year earlier and 31% the year before.
Put together: AI spend is growing fastest where procurement does not see it, most organizations cannot say accurately what AI software they have, and the people responsible for cloud cost have already been handed the problem.
Why AI escapes the usual controls
AI tools do not arrive the way enterprise software used to. Five things make them hard to see:
- Low entry price. A personal plan costs about the same as a lunch and fits under every expense approval threshold.
- Many channels. The same model can be bought as a seat, called through an API, consumed through a cloud marketplace or included in a suite the organization already owns.
- Keys instead of people. API access is tied to keys and service accounts. An agent running on a schedule consumes tokens with no named user behind it.
- Bundling. Copilot Chat comes with eligible Microsoft 365 plans and Google bundles Gemini features into Workspace. Some AI arrives without anyone buying it.
- Meters behind seats. Even approved tools often bill usage on top of the seat, as Tokens, Explained for the People Who Pay the AI Bill describes.
Where to look
No single source finds everything. Six together find most of it:
| Source | What it finds | What it misses |
|---|---|---|
| SSO and identity provider | Sanctioned apps, and unsanctioned ones users sign into with corporate credentials or OAuth grants | Personal accounts on personal email |
| Expense and corporate card data | Personal and team subscriptions paid by employees and reclaimed | Free tiers; anything not reclaimed |
| Accounts payable and vendor master | Invoiced AI vendors and resellers, including SaaS products with AI add-ons | Usage behind an invoice |
| Cloud billing and marketplaces | Model APIs bought through AWS, Google Cloud and Azure, including marketplace purchases that draw down a cloud commitment | Who in the business uses them |
| Browser and endpoint inventory | Desktop AI apps, browser extensions and AI features inside installed software | Server-side and API use |
| API keys and service accounts | Direct API use, by key and project, from each vendor's admin console or usage API | Keys created in personal accounts |
The last row is the one most programs skip. Anthropic's Usage and Cost Admin API reports usage by API key and workspace, and OpenAI's organization usage and costs endpoints report by project and key. A key with spend and no known owner is the API equivalent of an unassigned license.
The same capability, bought several times
Once the sources are combined, the usual finding is duplication. A general-purpose assistant can arrive as Microsoft 365 Copilot or Copilot Chat, ChatGPT Business or Enterprise, Claude Team or Enterprise, Gemini in Google Workspace, and personal plans of all four on expense reports. Coding assistants repeat the pattern on the developer side, often with both a seat and a usage meter, as Cursor's pricing shows.
Duplication is not automatically waste. Different teams may have good reasons for different tools, and a second vendor reduces lock-in. But each overlap should be a decision with a reason and an owner, not an accident of who had a corporate card. The Modern Guide to AI-Powered Software Rationalization sets out how to make those calls without stopping the teams that are getting value.
Ownership and policy
Discovery without ownership produces a list nobody acts on. Three decisions make it stick:
- Every AI subscription and every API key gets an owner. A person who can say what it is for and approve its cost. Keys without an owner are disabled after notice.
- Approved routes are easier than unapproved ones. If the sanctioned assistant takes six weeks to request, the expense report wins. Publish what is approved, for which data, and how to get it in a day.
- Spend limits sit where the meter is. Per-key and per-project budgets in the API consoles, per-agent caps in the platforms that offer them, and an expense policy that routes AI subscriptions to the approved channel.
Unknowns that cannot be resolved yet belong in the record too. A Register of Unknowns Beats a Falsely Complete Inventory explains why an honest gap is worth more than a total that looks complete.
The first 30 days
- Days 1 to 5: pull 12 months of expense and card data and search it for AI vendors and AI products. Export the identity provider's application and OAuth consent list.
- Days 6 to 10: pull accounts-payable vendors with AI products or AI add-ons, and cloud billing by project and SKU for model APIs and marketplace purchases.
- Days 11 to 15: list API keys and projects in every AI vendor console the organization controls, with usage and an owner for each.
- Days 16 to 20: merge the lists into one register: tool, channel, cost, users or keys, owner, contract term.
- Days 21 to 25: mark duplicates and decide, per overlap, whether to keep, consolidate or retire. Identify the personal plans that should move to an approved route.
- Days 26 to 30: publish the approved tools and the request route, set spend limits on keys and projects, and schedule the next pull for 90 days out.
The question this leaves open
The thirty days produce a register. It goes out of date the week after, because new keys, new agents and new subscriptions keep arriving. Where do the seats, the meters and the keys sit side by side, continuously, so that the register is a view rather than a project?
Since 3 November, part of that answer is in LICENSEWARE. SIM's SSO connectors for Microsoft Entra ID, Google Workspace and Okta show which SaaS apps people have access to, and its API connections to Anthropic Console and Enterprise, OpenAI and ChatGPT Enterprise, Google Gemini, Microsoft 365 Copilot, GitHub Copilot and Cursor add detailed token analysis and usage per user. Subscriptions on personal cards still need the hunt above; what the identity provider and the AI vendors' APIs know arrives without one.
To see your own AI spend per person, Software Inventory Manager (SIM) now connects to Anthropic Console and Enterprise, OpenAI and ChatGPT Enterprise, Google Gemini, Microsoft 365 Copilot, GitHub Copilot and Cursor: read how on the AI cost management page. For the cost side of the same problem, read If You Cannot Read the AI Bill, You Have No Position and Microsoft's AI Bill Has Three Meters.
