What question did this study set out to answer?

To identify and mitigate shadow AI risks in small and mid-sized organizations without dedicated security staff.

May 29, 20260 citationsOpen Access

Detecting Shadow AI in Small and Mid-Sized Organizations: A Lineage-First Detection Framework for Organizations Without Dedicated Security Staff

NTNarnaiezzsshaa TruongAmerican Rock Mechanics Association

Key Points

To identify and mitigate shadow AI risks in small and mid-sized organizations without dedicated security staff.
Developed a lineage-first detection framework tailored for small and mid-sized organizations.
Utilized behavioral signals, provenance gaps, and delegation boundary violations for detection.
Introduced operational tools like Helper-Shadow Test and four-declaration attestation model for immediate deployment.
Established a structured approach to detect undeclared AI use in SMBs.
Demonstrated that the detection methods can be utilized by non-technical staff.
Proposed practical solutions that do not require specialized software or technical knowledge.

Abstract

Enterprise AI governance tools—CASB platforms, DLP solutions, network-layer AI detection—exist for large organizations with dedicated security staff. Small and mid-sized organizations face the same shadow AI risks with none of the same tooling options. This technical note presents a lineage-first detection framework for SMBs: a structured approach to identifying undeclared AI use through behavioral signals, provenance gaps, and delegation boundary violations, requiring no specialized software and no technical staff. The framework reframes shadow AI not as a tool inventory problem but as a lineage discontinuity problem—and derives detection methods from that reframing. The most operationally useful elements—the Helper-Shadow Test, the Sunlight Rituals, and the four-declaration attestation model—are designed to be deployable immediately by non-technical staff in any SMB environment.

Ask AI

Helpful

Bookmark

View Full Paper