state of the art: rogue APs, physical detection

I searched. Been a while.

I'm looking for a state of the union on rogue APs. I manage small Cisco shops and we use basic network sanitization and strict controls with open access to admins for approval. In short, we try to make it more work to shadow IT than it is to ping us to work with the situation. I'd like to think nobody is happy. That's compromise.

That said, I've got a friend working a project who is being tasked with a segment on physically tracking rogue APs and I've been accessed as a resource. My General Sanitation and Sanity response didn't go over well. Client is HIPAA.

I'm resistant to talking about specific tooling, so my question is this:

How do you deal with the threat of rogue APs? What have I missed? I have a friend who says she's got some beta Terminator shit for visualizing radio spectrums in VR/AR but admits it's kinda half gimmick. For now.

What's the cutting edge for finding a needle in a stack of needles? How do you find the rogue APs if your network tools are abolished-- and which do you use if they aren't?

Thanks folks.