Course Objective & Scope
The biggest source of corporate AI data exposure rarely comes from sanctioned projects; it comes from employees pasting sensitive data into personal LLM accounts, unvetted meeting-recording bots, browser extensions and AI features silently turned on by default inside existing SaaS platforms. This course teaches security, IT and governance teams how to discover and control Shadow AI without driving employees underground.
It covers Shadow AI discovery via CASB, SWG and OAuth logs, browser and DLP guardrails, governing embedded AI features in legacy SaaS tools, fast-track tool triage and directing staff toward approved enterprise alternatives. Participants build a 60-day Shadow AI Discovery and Control Plan for their organisation.
Who Should Attend?
- Information security (CISO), security operations and DLP/CASB managers
- IT governance, enterprise architecture, SaaS asset management and procurement teams
- Compliance, data privacy (KVKK/GDPR) and enterprise risk leads
- AI CoE and digital workplace leaders providing safe internal AI tools
Key Takeaways
- Discover unsanctioned AI web apps, browser extensions, OAuth integrations and meeting bots across the enterprise
- Audit and control embedded AI features silently activated inside existing SaaS platforms
- Design graduated enforcement rules: block, coach/warn, redact PII or redirect to approved tools
- Revoke risky third-party OAuth tokens and prevent corporate email sign-ups on consumer AI services
- Pair technical controls with safe internal AI alternatives and a fast-track tool request process
Curriculum
Anatomy of Shadow AI: Vectors and Root Causes
- Four primary vectors: consumer web LLMs, browser extensions, meeting-note bots and embedded SaaS AI
- Why blanket blocks backfire when employees switch to personal devices or mobile networks
- What leaks most often: source code, client proposals, legal drafts, spreadsheets and meeting transcripts
Discovery and Visibility: CASB, SWG, DNS and OAuth Audits
- Mapping AI service usage through Secure Web Gateways (SWG), CASB and DNS logs
- Auditing corporate SSO/OAuth grants given to unvetted third-party AI apps
- Inventorying AI browser extensions and local desktop tools via endpoint management
Governing Embedded AI Inside Existing SaaS Platforms
- Tracking AI features quietly rolled out inside CRM, HR, ticketing, design and collaboration suites
- Auditing admin consoles to disable opt-out model training and cross-tenant data sharing
- Reviewing vendor AI addendums during SaaS contract renewals
Graduated Technical Controls: DLP, Browser Coaching and Redirection
- Tiering tools into Sanctioned Enterprise, Monitored/Coached and Blocked categories
- Applying inline DLP to block pasting of source code, PII, credentials and confidential documents
- Using real-time browser coaching pop-ups to redirect users to approved internal AI tools
Safe Enablement, Fast-Track Triage and 60-Day Action Plan
- Standing up a lightweight 5-day triage lane for business teams requesting niche AI tools
- Workshop: designing a Shadow AI amnesty/discovery campaign and 60-day control roadmap
Other Courses in This Category
-
Translate fairness, transparency, accountability, privacy, safety and human agency from abstract commitments into practical checklists across AI design, procurement and daily business operations.
- Live Course
- 5 modules
-
Understand ethical harms such as manipulation and deepfakes alongside AI safety and security threats—prompt injection, jailbreaks, data poisoning and OWASP LLM Top 10—and govern guardrails and red teaming.
- Live Course
- 5 modules
-
Build an enterprise AI governance framework that scales innovation safely: establish an AI system inventory, run risk-proportionate stage-gates across the lifecycle, and report risk and value to the board.
- Live Course
- 5 modules
-
Draft clear, enforceable corporate AI policies covering employee Generative AI Acceptable Use, data classification rules for prompts, AI procurement and development standards, and rollout communication.
- Live Course
- 5 modules
-
Close accountability gaps across AI systems by designing a Three Lines of Defence model and a clear RACI matrix linking business owners, AI product managers, model stewards, compliance, security and internal audit.
- Live Course
- 5 modules
-
Classify enterprise AI systems into risk tiers based on intended purpose, autonomy, affected stakeholders, data sensitivity and EU AI Act criteria, and map mandatory controls to each tier.
- Live Course
- 5 modules
Get in touch
