Two attack surfaces, one agent: shadow AI (humans using tools you didn't approve) and non-human identities (machines with privilege nobody reviews). The blind spots that nobody else is looking at.
Detects unauthorized ChatGPT, Claude, Gemini, Copilot, Perplexity, and other consumer AI tool usage in browser traffic. Identifies which users, which departments, and what data category is being pasted in — without intercepting content.
Service accounts holding Owner / Global Admin / *:* permissions. The non-human identities that could rebuild your entire cloud from scratch and that nobody ever audits because they're not on the IAM team's quarterly review list.
API keys not rotated in 2+ years. SHADOW ages every key in Azure Key Vault, Azure RBAC, Azure service principals, third-party integrations (Stripe, Twilio, SendGrid, Datadog, GitHub PATs) and ranks by age and privilege.
Azure AD Enterprise Application with zero owners listed, zero recent sign-ins, but live OAuth grants. Half of these were proof-of-concepts from years ago. The other half are real attack surface no one will renew or revoke.
Azure managed identities and Azure RBAC roles assigned to deleted resources, with permissions still in effect. Forgotten ghosts that show up in compromise simulations because they're easy lateral-movement targets.
SHADOW correlates effective permissions of every non-human identity against the average privileged human in your environment. When a build pipeline service principal can do more than your CISO, that's the finding.
Long-lived OAuth refresh tokens belonging to applications that haven't been used in 180+ days. Revoking these dramatically reduces token-replay attack surface and forces re-consent for stale apps.
Third-party SaaS apps that requested broad Microsoft Graph / Google Workspace / Slack scopes (Mail.Read, Files.ReadWrite.All, admin scopes) and got user-consent grants that should have been admin-consent only.
SHADOW does not require a browser extension, an endpoint agent, or a network proxy. It reads from Azure AD sign-in logs, Azure Activity Log, Okta system logs, and Entra ID. Zero install footprint on user devices.
Identity providers, cloud IAM, and SaaS directories. SHADOW reads from each one and correlates non-human identity reach across all of them.
Read sign-in telemetry. Enumerate identity inventory. Correlate effective permissions. Surface what nobody is reviewing.
Pulls sign-in logs from Azure AD / Entra ID, Azure Activity Log identity events, and system logs from Okta. Read-only API access. No user-device telemetry required.
Builds the full inventory — every human identity, every service principal, every managed identity, every Azure RBAC role, every OAuth app, every API key. Tags each with effective permissions and last-used timestamp.
For shadow-AI signals, parses sign-in patterns to AI service domains. For NHIs, computes effective permissions, owner status, age, and last-use across the entire inventory.
Findings hand off to FORGE for safe remediation (revoke, rotate, scope-down, decommission) and to COMPLY for evidence on identity-related controls (HIPAA 164.312(d), PCI 8, NIST IA-family).
In a real Azure tenant audit, SHADOW found 3,200 non-human identities — 47 of them with effective Owner permission on production subscriptions, 19 with API keys older than 3 years, and 28 orphan Enterprise Application with zero owners and live OAuth grants. The shadow-AI scan flagged 41 employees pasting business data into consumer ChatGPT in the prior 30 days. Total time from connect to full report: under 12 minutes. None of it had been visible in the customer's existing IAM tooling.
“ SHADOW exposed a non-human identity sprawl problem we genuinely did not know we had. ”
SHADOW is included in every TITAN AI platform package. Identity hygiene without remediation, posture, and compliance evidence is half a product — we ship them together.