"Shadow IT" used to mean an employee signing up for Dropbox with their work email without telling anyone. In 2026 it means something bigger: someone on your team pasting company data into a random AI chatbot, an engineer spinning up an AI agent that nobody in security signed off on, or a developer installing an npm package that turns out to be malicious — all without anyone finding out until something goes wrong. You can't secure what you can't see, and "what's actually running" now spans three different surfaces: the SaaS apps employees sign up for, the AI models and agents running inside your infrastructure, and the packages sitting on developer laptops. Here are three real tools, each built for one of those three blind spots.
The SaaS/AI signup blind spot: Nudge Security
The classic shadow IT problem, updated for the AI era: employees signing up for SaaS tools and AI apps with their work email, one login at a time, until IT has no real picture of what your company's data is actually connected to. Nudge Security discovers this shadow SaaS and shadow AI usage — not just the tools IT officially approved — and adds an OAuth risk score plus automated remediation "nudges" rather than just handing you a static report to act on manually.
For who: IT and security teams at companies of 50+ employees who want visibility and control over SaaS and AI sprawl.
Pricing: quote-based; there's a 2-week free trial with no card required, but enterprise pricing isn't published.
Honest limits: opaque pricing that requires a sales conversation, likely overkill for a small team without real compliance pressure, and it depends on integrating with your core identity/workspace tools (Microsoft 365, Google Workspace, Okta) to actually work.
The unmanaged-agent blind spot: Orbyx AI SPM
Different problem, same root cause: once teams start deploying AI models and agents themselves, security often loses track of which ones exist, let alone which ones are risky. Orbyx AI SPM is an open-source dashboard that inventories every AI model and agent running inside a company — including the unofficial ones nobody signed off on — combining discovery, risk scoring and policy enforcement (via an OPA engine, with Prometheus/Grafana for monitoring), plus runtime detection of suspicious agent behavior.
For who: security and platform teams at organizations actually deploying AI models and agents in production who want visibility into shadow AI and pipeline compliance.
Pricing: free and open source (Apache 2.0), fully self-hosted — costs are limited to whatever Kubernetes infrastructure you run it on.
Honest limits: this is a very young project (13 stars, 1 fork, 10 open issues at last check), it requires a Kubernetes cluster and real ops skills to run, and there's no managed/hosted option if you'd rather not operate it yourself.
The unscanned-dependency blind spot: Bumblebee
The third blind spot lives on developer laptops, not in the cloud: hundreds of npm packages, PyPI libraries, VS Code extensions and MCP servers, most of which nobody has ever checked against known supply-chain threats. Bumblebee, a free scanner released by Perplexity, checks all of them at once across 8+ ecosystems (npm, PyPI, Go, RubyGems, Composer, MCP servers, editor extensions and more) in a single pass — as a static, read-only Go binary that never executes or modifies anything it scans, outputting structured NDJSON with confidence levels.
For who: DevSecOps and incident response teams who need a fast inventory check across developer machines, especially the newer categories like MCP servers that older scanners don't cover.
Pricing: free and open source (Apache 2.0).
Honest limits: it's a focused inventory/detection tool, not a full security platform — it doesn't replace a proper dependency vulnerability scanner like Snyk or Dependabot, and it's aimed primarily at an already security-literate audience.
Side by side
| Tool | What it watches | Price |
|---|---|---|
| Nudge Security | Employee SaaS/AI signups and OAuth risk | Quote-based, free trial |
| Orbyx AI SPM | AI models and agents running in your infra | Free, self-hosted (needs Kubernetes) |
| Bumblebee | Packages, extensions and MCP servers on dev laptops | Free, open source |
The honest bottom line
None of these three tools compete with each other — they're not alternatives, they're complements, each covering a surface the others don't touch. A mid-size company genuinely worried about shadow AI risk plausibly needs all three at some point: Nudge Security for the SaaS signups happening outside IT's knowledge, Orbyx AI SPM for the agents and models already running in production, and Bumblebee for what's quietly installed on the machines writing the code in the first place. If you can only start with one, start wherever the actual pressure is coming from — a compliance audit points you toward Nudge Security, an AI incident points you toward Orbyx, and a supply-chain scare points you toward Bumblebee.