AI tools nobody approved

Find the AI tools reading your mail, without deploying anything.

Discover, shadow AI governance

Book a demoWhat it covers
AI tools against the permissions each one was granted, with how many people granted them and the decision
01Where it goes wrong

Someone signed into an AI notetaker with their work account on Tuesday. It asked for Mail.Read. They clicked allow.

For whoever gets asked what people are using.

02What the industry reports

What the industry reports

  • 81%of employees use AI tools their employer has not approvedUpGuard, State of Shadow AI 2025
  • 93%of executives and senior managers use them tooUpGuard, State of Shadow AI 2025
  • 3 in 4shadow AI users have put possibly sensitive information into oneUpGuard, State of Shadow AI 2025
03What changes

What changes

Discovery starts with no deployment

Sign-in logs, OAuth grants and email metadata you already hold.

A grant is judged on what it reaches

Mail.Read on a notetaker is not the same risk as a profile read. The scope analyzer says what the permission opens.

Sanction, review or block, as one decision

Every discovered tool carries an owner, a status and a score. Nobody has to run a survey to learn what people are using.

04What it covers

Everything this covers.

Discovered applications with their risk score and the sources that found each one
01Discovery
01

Discovery

  • Sign-in logs, OAuth grants and email metadata you already hold
  • A browser extension for what the directory never sees
  • Nothing to install on a laptop and no proxy to stand up
Discovered applications with their risk score and the sources that found each one
02

Risk assessment

  • Every application scored from 0 to 100, with its OAuth scopes weighed in
  • Scopes read out with who consented, when and from where
  • AI tools flagged as they arrive in the catalog
A discovered AI tool measured by who granted it and what its OAuth scopes reach
03

Governance

  • Sanction, review or block, as one decision on the application
  • Every OAuth grant to an app revoked in one action
The application catalog filtered to apps with no owner, with an owner being assigned to one
04

Ongoing control

  • Vendor breach records, CVEs and status incidents sit on each app, beside the people who use it
One vendor’s risk over time, stepping up at a breach record, a CVE and a status incident
05What does the work

The parts of the product this uses.

Shadow AISee which AI tools your people gave access to your data
Shadow IT discoveryFind the applications nobody ever submitted a ticket for
App catalogNothing in the catalog sits unowned or unclassified
The productAll of DiscoverHow Nuvio works
06On your own tenant

See it on your own tenant.

Book a demo

Connect your directory and see findings the same day.

The graph behind it