Why it matters
It usually starts with good intentions. Someone signs up to a chatbot with a personal account to draft an email faster, or connects an AI note-taker to their calendar. Each case is small. Together they mean company data flows to services nobody has assessed, under terms nobody has read.
Banning AI rarely works: it pushes use onto personal devices and accounts, where it is even harder to see. The workable answer is to find what is in use, sanction what is safe, and set rules for the rest.
How Qastel handles it
Qastel finds shadow AI in signals you already have: sign-ins in Microsoft Entra ID or Google Workspace, traffic in your CASB or secure web gateway, and the Qastel browser extension, which also sees the AI tools people use with a personal account.