Systems | Development | Analytics | API | Testing

Shadow AI detection is the practice of finding and governing unsanctioned AI tools, models, and API integrations that employees deploy without security approval. It has become urgent because these tools route live enterprise data to external models in real time, and traditional security stacks cannot see them. The 2026 Cordyceps disclosure, which exposed identical AI-generated vulnerabilities across 300+ GitHub repositories, showed how fast ungoverned AI can turn into a supply-chain crisis.

We shipped v2 of a small products API on a Thursday. Green CI. Green replay. The new search endpoint worked. I went home feeling competent. Friday morning I ran the same traffic against both builds with proxymock and compared the SQL. v2 had added 80 queries on the same HTTP script. A per-product audit COUNT was firing inside the list handler. A startup migration had run ALTER TABLE and CREATE TABLE audit_log. Total DB time was up 70 ms on a demo that should have been boring.

*Kong makes every MCP client and server work with Enterprise-Managed Authorization, whether they speak the protocol or not.* The MCP demo impressed the room. Then someone asked how 5,000 employees would connect to 40 MCP servers, and the answer was: one OAuth consent screen at a time. Per user. Per server. No central policy, no unified audit trail, and nothing stopping a personal account from getting wired into a work tool.

A customer emailed on a Tuesday: checkout hung for ten seconds. I opened our tracing tool, punched in the time window, and got nothing. The trace was sampled out. We keep 1% of traces, like most shops with real traffic do. The one request that actually mattered was in the 99% we threw away. I spent twenty minutes admiring our observability stack before admitting it couldn’t answer a first-grader’s question: what happened to this person? Here’s what I know now.

Enterprise AI adoption is accelerating. In PwC's April 2025 survey of 308 US business executives, 88% said they plan to increase AI-related budgets in the next 12 months . But scaling AI from pilot to production exposes a structural problem most teams discover too late: **direct LLM API integration** creates fragility at scale. The question is not whether your organization will consume multiple LLMs. It is how you will govern that consumption without building bespoke infrastructure for every provider.