AI adoption is making it harder for security teams to maintain visibility into what employees are actually using.

I'm particularly interested in Shadow AI, AI agents, MCP servers, and AI enabled developers tools running on employee endpoints.

How are security teams getting visibility into these tools and assessing the security risks around them?

Are you using existing endpoint, DLP, proxy or identity controls or have you added something specifically for AI governance?

I'd be interested in what has actually worked in production, especially for detecting unsanctioned AI usage without simply blocking everything.