Threat Landscape

Shadow AI threat landscape
you can act on

This page maps common Shadow AI risks to what Spur can detect and control today. It’s aligned to the actual collectors (Chrome/Edge extension + macOS endpoint agent) and the admin portal features.

Threat matrix

Each card includes a concrete threat identifier, related MITRE ATT&CK techniques (the data-movement or account-use behaviors the risk aligns with), the signal Spur can produce, and the control surface (policy, DLP rule, block).

GDPR breach

Customer data, CRM exports, or personal data pasted into consumer AI tools without a DPA or approved safeguards.

On-device DLP Block/Warn/Log Audit trail
MITRE ATT&CK
T1567.002 T1213

Shadow AI adoption (unknown tools)

Employees use new AI tools without IT awareness, creating unmanaged data exposure and inconsistent controls.

Tool registry match Unknown tool flag Alerts
MITRE ATT&CK
T1078.004 T1071.001

Policy bypass via desktop apps

Native AI apps and local model runtimes can bypass browser-only controls and create blind spots.

macOS agent detection App enforcement Alerts
MITRE ATT&CK
T1204 T1059

SOC 2 audit failure

Inability to show who used which AI tools, what was blocked, and what policies were in effect during an audit window.

Audit log Snapshot export User attribution
MITRE ATT&CK
T1567.002 T1078.004

No SIEM visibility

Violations, detections, and sensitive-data blocks stay siloed outside your security monitoring workflows.

Webhook forwarding Splunk/Sentinel/Elastic High-signal mode
MITRE ATT&CK
T1567.002 T1048.003

Data leakage incident

Credentials, source code, or regulated data sent to non-approved AI tools due to weak “log-only” controls.

Chrome DNR block Extension enforcement DLP rules
MITRE ATT&CK
T1567.002 T1552.001

Important constraints

Spur is designed not to collect prompt content by default. DLP runs on-device in the browser extension, and events focus on metadata and policy outcomes.

MITRE links describe underlying behaviors (exfiltration over web services, valid cloud accounts, etc.). Shadow AI risk often involves employees using legitimate tools — not only malicious actors — but the same techniques apply to detection and audit evidence.