Unauthorized AI Usage Discovery Automation: "No Detections" Is Not Proof of Nothing

Every AI governance conversation eventually runs into the same false comfort: a company inventories the AI tools it knows about, secures those, and treats the exercise as complete. The actual risk was never in the tools that got inventoried — it is in the ones nobody registered: a free AI writing assistant an employee found on their own, a personal account used to paste a client document into a chatbot, an old API key still calling a model the organization has since banned. A discovery tool that only shows something when it catches an obvious case is worse than no tool at all, because it converts a real unknown into a false confidence.

Selling "complete visibility" is a much easier pitch than selling "here are the eight sources we can actually see today, and the twelve we cannot yet." The second pitch is honest and the first is what gets bought — so most tools default to language that implies more than the underlying collection actually delivers, and the gap between the promise and the reality is exactly where a real gap in usage goes unnoticed with false confidence attached to it. Compounding that, many detection systems store the evidence itself in full — the actual prompt text, the actual document — turning the tool built to reduce risk into a second place where sensitive content now sits.

Evidence moves through a fixed, deterministic pipeline — collection, validation, normalization, correlation, classification, scoring, case, human decision, record — with no generative AI at any step and no automatic blocking: the engine classifies, scores and organizes the queue, and the decision is always a person's, recorded and auditable. Every piece of evidence is tagged with one of three honest confidence tiers: observed (evidence seen directly from the source), inferred (an indirect signal, such as a DNS resolution for the domain), or suspected (a weak signal on its own). A detection resolves into one of eight real outcomes — confirmed, false positive, already registered, temporarily ignored, exception granted, mitigated, converted to an asset, or closed — and none of that classification is left implicit. The evidence model itself has no column for prompt content, typed text, passwords, tokens, generated responses or full documents — not a policy choice enforced by application logic, but the literal absence of anywhere to put that data, confirmed at the schema level. A dedicated coverage page names exactly what is and is not being watched, and an automated test permanently forbids the page from ever claiming "total coverage," "100%," "guaranteed" or "zero risk" in any scenario, including one where every possible source is active; when no source is configured, the page states outright that an absence of detections does not mean an absence of usage. Twenty discovery surfaces are declared with the same honesty: eight work today through an authenticated ingestion API (api, gateway, proxy, dns, firewall, sso, expenses, sdk), three work through manual registration in the interface (manual, report, vendors), and nine are modeled but have no real connector yet (csv, xlsx, webhook, extension, casb, oauth, integration, code repository, endpoint) — each pending surface is required to declare, specifically, the technical dependency still missing, and no pending source is allowed to generate a synthetic event that could be mistaken for a real one. Ingestion itself is hardened: access tokens are never stored, only their hash; the organization a detection is attributed to is derived from the credential on the server side and cannot be overridden by anything the calling source sends, confirmed by testing a forged organization ID against another organization's credential and watching it write to the correct organization anyway; duplicate submissions are rejected by an idempotency key; timestamps too far in the future or too far in the past are rejected outright; and both request size and batch size are capped.

A security lead opens the discovery queue after a quiet month and, before trusting the silence, checks the coverage page first. It shows plainly that eight surfaces are actively collecting — including the corporate SSO and the expense-report feed — and that browser-based usage, the single largest source of shadow AI in most organizations, has no connector yet; the page states this explicitly as a declared gap, not as a working feature.

A week later, the expense-report surface flags a recurring charge to a known AI tool vendor with no corresponding entry in the AI asset inventory. The unregistered_ai_tool rule fires with an "inferred" confidence tier — the signal is indirect, a billing line item, not a direct observation of usage — and a case opens. Triage confirms it: a team had quietly adopted the tool three months earlier without registering it. The detection converts to a registered asset, closing the case with the trail of exactly how it was found.

Meanwhile, a second alert — a personal Gmail address authenticating to a known AI chatbot from a corporate network — carries an "observed" tier, a stronger signal. A reviewer with view_sensitive access opens the underlying evidence; a colleague without that permission sees only that a detection exists, not its content.

The structural change is that "we haven't seen anything" stops being treated as equivalent to "there is nothing to see." Detections carry the evidence, the confidence and the specific rule that fired, so triage does not start from a hunch. The coverage page keeps the tool's own limits visible rather than letting a clean queue quietly imply more safety than the collection actually supports. Centriu attaches no figure to what this prevents; it depends entirely on how much of an organization's AI usage was genuinely unregistered.

An organization with a handful of employees and one centrally issued AI tool has little unregistered surface to discover — the exposure this addresses grows with headcount, with the number of teams that can adopt a tool independently, and with how many of the twenty discovery surfaces are actually connected.

An AI tool inventory answers "what do we know we're using" — a necessary but structurally incomplete question, because it can only ever list what someone already registered. Centriu TrustOps's discovery engine is built to answer the harder question — what is being used that nobody registered — with a deterministic, evidence-first pipeline and, just as importantly, an explicit, tested refusal to let its own current blind spots be mistaken for a clean bill of health.