Last verified 2026-07-27: 778 tools, 963 detection domains. Downloads always serve the current set.
The Shadow AI List
The maintained, risk-ranked directory of the AI tools your people and their agents reach for - load it into your firewall, SIEM, and DLP to decide what to allow, log, or block.
Look up any of the free top 100. The full pack covers all 778 tools and every risk score.
778 tools tracked, every detection domain re-verified 2026-07-27. Two honest cuts of the registry: the tools most likely already in use, and the highest data-risk scores.
The AI tools you already recognize, by monthly web traffic
Top risk score, at any popularity
See the full ranking on /top, or get all 778 tools with scores.
New ones ship every week. We maintain the 778 most likely to reach enterprise data, risk-ranked. The 15 below rank high for data risk and rarely make it onto a policy.
| Tool | Category | Enterprise use | Risk |
|---|---|---|---|
| DeepSeekdeepseek.com | chatbot | medium | 82 · Critical |
| QuillBotquillbot.com | writing | high | 58 · Moderate |
| Vanna AIvanna.ai | data analytics | medium | 74 · High |
| Wisprwisprflow.ai | productivity agents | medium | 74 · High |
| Adobefirefly.adobe.com | image video | high | 55 · Moderate |
| Sybillsybill.ai | sales marketing | medium | 70 · High |
| ChatPDFchatpdf.com | productivity agents | medium | 67 · High |
| Flikifliki.ai | image video | medium | 67 · High |
| Limitlesslimitless.ai | meeting transcription | medium | 67 · High |
| Pictorypictory.ai | image video | medium | 67 · High |
| Gammagamma.app | productivity agents | high | 50 · Moderate |
| Adaada.cx | sales marketing | medium | 60 · High |
| Avomaavoma.com | meeting transcription | medium | 60 · High |
| Dustdust.tt | agent tooling | medium | 60 · High |
| HeyGenheygen.com | image video | medium | 60 · High |
High-risk AI tools that aren't household names. See the full ranking, headline tools included, on /top.
Staff and their AI agents adopt new tools faster than any team can track. The Shadow AI List is the running map of what exists, so the AI on your network stops being invisible.
Every tool is risk-ranked on what matters: where data goes, whether it trains on your inputs, enterprise controls, and how widespread it is. Spend your attention on the real exposure.
A maintained, methodology-backed source you can build policy on: allow / log / block decisions, audit evidence, and the detection domains your DNS, firewall, and SIEM already use.
Jump to the riskiest AI tools in each category, ranked by exposure.
A solo dev uses it as a ready-made list instead of building one. An SME with no security team uses it as the shortcut to a real AI policy. An enterprise GRC function uses it as defensible, maintained governance data. Same registry, priced for each.
New use
Shadow AI is not only on your network. Staff expense ChatGPT, Cursor, Midjourney, and the long tail of AI tools on corporate cards with no security or procurement review. The same registry catches them there too: the pack ships an ailist-expense-scan.csv lookup (merchant name, risk score, trains-on-data, verdict). Export your card or expense transactions, VLOOKUP the merchant column against it, subtract your approved tools, and what is left is unapproved AI bought on the company card. Group by cardholder to see who.
Catches branded charges (the AI vendor name on the statement). Merchant-of-record billing (Paddle, Stripe, FastSpring) can mask the vendor, so treat it as a strong starting list and pair it with the detection domains for the free tiers that never hit a card.
Pricing
Names are free. The full risk-ranked registry is the product - pick by how current you need to keep it.
Free top 100
$0
Top 100, names only
The 100 highest-exposure AI tools - names, domains, category. Email and download. Enough to start a blocklist today.
Get it freeShadow AI List Pack
$199one-time
Full registry - a snapshot, yours forever
All 778 tools with full risk scores, data-handling flags, and detection domains - plus drop-in Sigma, STIX/MISP, and firewall/hosts lists. Permanent re-download.
Buy the pack - $199Pack + weekly updates
$499/ year
Full registry - re-shipped every week
Everything in the pack, re-verified and re-shipped weekly: new tools, new domains, updated risk, a changelog per release. Never goes stale.
Subscribe - $499/yrEnterprise
Custom
Pushed live to your stack
A live auto-updating feed your firewall polls, SIEM detection rules, NDR / OAuth / code-scan signals, a full API, and onboarding support.
Talk to us| Feature | Free $0 | Pack $199 | Pack + updates $499/yr | Enterprise Contact us |
|---|---|---|---|---|
| AI tools covered | Top 100 | All 778 | All 778 | All 778 |
| Risk scores + data-handling flags | - | |||
| Detection domains (firewall / SIEM import) | - | |||
| Live auto-updating feed your firewall polls | - | - | - | |
| SOC formats (Sigma, STIX/MISP, firewall + hosts lists) | - | |||
| Corporate-card / expense scan lookup | - | |||
| Endpoint, browser-extension, OAuth + code-scan signals | - | - | - | |
| API + webhook | Public top-100 | - | - | |
| Updates | Weekly | Snapshot | Weekly | Pushed to your tools, weekly |
| Support | - | - | Priority + onboarding |
Self-serve checkout via Stripe. Re-downloads from /account. Enterprise is talk to us.