Shadow AI in SaaS is exposing data and training risks

At a glance

What this is: This is an analysis of Shadow AI in SaaS, showing that hidden AI capabilities can expose organisational data, IP and proprietary knowledge to model training and uncontrolled sharing.

Why it matters: It matters because identity and governance teams now have to control SaaS AI usage, user agreement risk and data-learning behaviour, not just discover sanctioned applications.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.

Context

Shadow AI in SaaS is the overlap between unsanctioned AI apps and mainstream software that embeds AI features without clear user awareness. In this article, the governance gap is not simply discovery, but control over how those AI capabilities learn from, store and reuse business data.

The article argues that employees can unintentionally approve data use conditions or expose sensitive content through ordinary SaaS workflows. For identity and access teams, that means the problem reaches across SaaS governance, data protection and user consent, rather than sitting in a single security tool category.

Wing Security frames this as a visibility and remediation problem inside the SaaS layer, where AI-enabled applications may be common but still poorly governed. The practical challenge is to identify where AI is present, who can trigger data-sharing behaviour, and whether remediation can keep pace with adoption.

Key questions

Q: What breaks when hidden AI appears inside approved SaaS applications?

A: Static app categories stop reflecting real risk once vendors embed GenAI or model connectivity into software that was already approved. The inventory still looks clean, but governance decisions, access reviews, and acceptable use policy are now based on stale assumptions about what the application can do.

Q: Why does the use of AI-enabled sub-processors create privacy and governance risk for SaaS buyers?

A: AI-enabled sub-processors can expand data exposure beyond the primary application because user content may be transmitted to additional systems for inference, automation, or support. That creates governance risk when teams do not understand where data goes, which controls apply, or whether the transfer is consistent with privacy commitments and internal approval boundaries.

Q: What are the signs that Shadow AI in SaaS is not under control?

A: Common signs include widespread AI feature use without central approval, unclear training settings, users sharing sensitive content into business apps, and remediation that depends on manual review. When discovery outpaces policy enforcement, the control environment is already behind.

Q: How should security teams implement SaaS discovery in environments where AI features are embedded across everyday business apps?

A: Security teams should treat SaaS discovery as an always-on inventory and access mapping control, not a one-time audit. The goal is to find hidden apps, browser-based AI tools, OAuth-connected services, and embedded copilots, then map who can access them and what data they can reach. Without that visibility, policy enforcement, data protection, and AI governance all start with blind spots.

Technical breakdown

How shadow AI appears inside SaaS applications

Shadow AI in SaaS is often not a separate model deployment. It is an ordinary SaaS product with embedded AI features, hidden prompts, or training defaults that users do not fully understand. That creates a governance problem because the security team may believe it is managing a normal business application while the application is also acting as a data consumer, data processor and model-learning interface. The risk is increased when users can enable AI features without central review or when the same product is approved for business use but not for training sensitive content.

Practical implication: Map AI-enabled SaaS features as a separate governance layer, not just as part of the application inventory.

Why model training turns SaaS data into a governance issue

When a SaaS platform can train on customer data, the question is no longer only whether data is protected in transit or at rest. The issue becomes whether the organisation has consented to model learning, whether the data is appropriate for that use, and whether proprietary material can be retained, reused or exposed through downstream model behaviour. That is a different control problem from classic SaaS access management. It blends data governance, privacy awareness and vendor configuration into one decision path.

Practical implication: Review whether SaaS AI settings allow training or retention by default and disable those paths where business approval is absent.

Why discovery alone does not close Shadow AI risk

Discovery tells you what is present, but it does not tell you whether the AI feature is permitted, whether the data classification is acceptable, or whether the application can be remediated automatically. In practice, decentralised SaaS use means risks emerge faster than manual review cycles can absorb. The control gap is therefore operational: organisations need not just visibility, but a way to restrict, permit or remediate AI usage at scale as SaaS adoption changes.

Practical implication: Pair discovery with policy enforcement and automated remediation so new AI-enabled SaaS use can be acted on immediately.

Threat narrative

Attacker objective: The objective is not necessarily external compromise, but uncontrolled model learning and data reuse that exposes sensitive organisational content.

1. Entry occurs when employees adopt SaaS applications with embedded AI capabilities or approve AI features inside tools already in use. The access path is legitimate, which is why the exposure is easy to miss.
2. Credential or permission abuse is not the primary issue here. The problem is user-driven data submission into AI workflows that can ingest sensitive information, proprietary knowledge or IP for model learning.
3. Impact follows when that data is stored, reused or distributed beyond the original business context, creating privacy, confidentiality and governance exposure across the SaaS layer.

Breaches seen in the wild

• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.
• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow AI in SaaS is a governance problem, not just a discovery problem. Security teams can inventory AI-enabled applications and still fail to control what those applications do with sensitive data. The decisive question is whether the organisation can prevent approved tools from becoming unauthorised learning surfaces for proprietary information. Practitioners should treat AI usage policy as part of SaaS governance, not a separate side issue.

Model training consent is now a control boundary. Many SaaS AI features turn ordinary user interaction into a data-sharing event, which means consent, classification and retention decisions need to be explicit rather than assumed. That shifts responsibility from simple application approval to operational governance over what content is allowed into AI workflows. The implication is that access approval alone no longer answers the risk question.

Shadow AI exposes the limits of manual SaaS review. By the time a security team discovers a new AI-enabled app, users may already have shared content, accepted terms or triggered model training. The named concept here is AI training drift: data starts in an approved business flow and ends up inside a model-learning path the organisation did not intend to authorise. Practitioners need controls that move at the speed of SaaS adoption.

SSPM is becoming the control plane for SaaS AI governance. The article points to automated remediation, restriction and approval workflows because static awareness is too slow for decentralised software use. That direction matters for both identity and data teams: who can use the application, what can be shared, and whether the AI feature is allowed must be managed together. Teams should expect SaaS governance to absorb more of the AI policy burden.

Shadow AI creates cross-domain accountability gaps. Identity teams, SaaS owners, privacy leads and security operations all touch the problem, but no single function owns the full path from application discovery to data-learning restriction. That makes the issue structurally difficult in mature programmes that still separate app inventory, access policy and data protection. Practitioners should align governance ownership before the next AI-enabled SaaS feature becomes normalised.

From our research library:

• Only 37% of organisations had policies for managing AI or detecting shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
• Read next: Shadow AI and AI Agent Discovery Guide

What this signals

AI training drift: once a SaaS tool can learn from user inputs, the risk shifts from simple data leakage to data being absorbed into a model-learning path the business never explicitly governed. That means security teams need policy enforcement that acts at the moment of SaaS use, not after a review cycle closes.

Discovery alone will not keep pace with decentralised SaaS adoption. Organisations need operational controls that can identify embedded AI features, restrict risky settings and quarantine unapproved applications before sensitive information is submitted to them.

For practitioners

• Inventory AI-enabled SaaS features Classify which sanctioned applications include embedded AI, hidden training options or user-facing AI assistants, then separate them from ordinary SaaS in governance reporting.
• Block unauthorised model training Review SaaS settings for data retention, reuse and training permissions, and disable defaults that allow sensitive content to enter model-learning paths without explicit approval.
• Automate Shadow AI remediation Create workflows that can restrict, permit or quarantine risky AI app usage as soon as discovery identifies an unapproved or impersonator application.
• Align data and identity controls Coordinate SaaS app approval, user consent review and sensitive data handling so identity governance and privacy governance act on the same AI exposure.

Key takeaways

• Shadow AI in SaaS turns ordinary application use into a governance problem because AI features can learn from, store or reuse sensitive business data.
• The article says AI usage is already widespread, which makes manual review too slow if the organisation wants to keep control over training and retention paths.
• Security teams need discovery, policy enforcement and automated remediation to keep SaaS AI use aligned with data, privacy and identity governance.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• AI Training Drift: AI training drift is the movement of organisational data into model-learning paths that were not explicitly intended or governed by the business. It happens when users submit sensitive information into AI-enabled SaaS features that can retain, reuse or learn from that content without clear approval.
• SaaS SSPM: SaaS SSPM is the practice of securing and governing SaaS applications by continuously discovering configuration, access and usage risk. In AI-heavy environments it also has to account for hidden AI functionality, data-sharing defaults and remediation workflows that can act on new risk quickly.
• Model Learning Path: A model learning path is any workflow through which user data, prompts or content becomes input to an AI system’s training, retention or adaptation process. For security teams, the issue is whether that path is sanctioned, sensitive-data-aware and governed before the content enters it.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.