Shadow AI is a governance gap, not a training failure

At a glance

What this is: Cyberhaven argues that shadow AI is a governance problem, not a training problem, because AI tools and agents operate outside the assumptions built into legacy policy and DLP controls.

Why it matters: IAM, NHI, and security teams need to treat AI tools and agents as governed systems with data access and operational identity, not as user-behaviour exceptions.

By the numbers:

• Endpoint agents grew 509% in 2025, according to Cyberhaven.

Context

Shadow AI is the use of AI tools, models, and agents without formal approval, and the governance failure starts when organisations try to control it with human-policy controls alone. Those controls assume deliberate user action, stable tool inventories, and discrete data transfers, while agentic tools can access data continuously across endpoints and APIs.

The identity angle is now unavoidable because AI agents behave like non-human actors with operational access, even when they are installed by human users. That creates an NHI governance problem inside an AI security problem, because the real control boundary is no longer the employee decision alone but the system’s runtime access and data movement.

A programme that was designed to manage shadow IT as a procurement and training issue will keep missing shadow AI’s scale and persistence. The article’s core argument is typical of current enterprise conditions, not an outlier case.

Key questions

Q: What breaks when shadow IT grows inside cloud and AI teams?

A: Shadow IT breaks visibility and control. Security teams lose track of which tools handle company data, who approved them, and whether they meet baseline requirements for access, logging, and retention. That blind spot can create compliance failures, data leakage, and unreviewed attack surface, especially when teams adopt AI services without governance.

Q: Why do AI agents make traditional governance controls less effective?

A: AI agents can perform work without a human making each step of the decision, which weakens policies built around user intent and approval checkpoints. Once an agent can read files, call APIs, and operate across sessions, the control point must move from the user’s decision to the system’s access and data handling.

Q: How do security teams know if shadow AI is actually under control?

A: Security teams know shadow AI is under control when they can inventory every agent, model workflow, and tool connection, then map each one to an owner and access scope. If they cannot explain who owns it, what it can access, and when it was last reviewed, it is not controlled.

Q: When should organisations treat an AI system as a non-human identity?

A: Treat an AI system as an NHI when it can authenticate, request tools, or perform actions without direct human supervision. At that point it needs inventory, lifecycle, least privilege, monitoring, and revocation controls just like other machine identities.

Technical breakdown

Why shadow AI breaks policy-based governance

Shadow AI breaks policy-first governance because policy assumes a human can decide not to use a tool, while agentic tools can execute the task anyway. An acceptable use policy can define approved behaviour, but it cannot observe every local install, browser-based assistant, or MCP-connected service across managed and unmanaged endpoints. Once an AI system can read files, call APIs, and generate outputs without discrete user transfers, the control problem shifts from approval to runtime visibility and data handling.

Practical implication: govern AI tools by observed access and data movement, not by policy documents alone.

Why legacy DLP misses agentic AI data flows

Traditional DLP is built around discrete events such as uploads, attachments, and copy-paste actions. AI agents do not always create those clean triggers. They can ingest files, include data in prompts, call external model endpoints, and move information through multiple systems inside one session, which makes the risky behaviour visible only in aggregate. That means the control layer has to follow the data path, not just watch the destination or a single transfer event.

Practical implication: extend monitoring to data lineage and prompt-driven flows instead of relying on event-only DLP.

What continuous inventory means for shadow AI

Continuous inventory is the difference between knowing a tool existed last quarter and knowing it is active now. In shadow AI, point-in-time reviews age out quickly because tools add agentic features, new integrations, and external API connections after approval. Inventory therefore needs to capture active AI applications, where they run, what data they touch, and whether they are sanctioned or shadowed. Without that runtime view, governance can only describe yesterday’s toolset.

Practical implication: establish continuous discovery for AI applications and agent-connected services across endpoints.

Threat narrative

Attacker objective: The practical objective is unauthorised access to sensitive enterprise data through AI-enabled workflows that operate outside normal governance visibility.

1. Entry occurs when employees install consumer AI tools, coding agents, or third-party integrations on endpoints without formal approval.
2. Credential and data access follow when those tools read files, consume prompts, and call external APIs across internal systems.
3. Impact is broad data exposure and governance loss, because legacy controls do not reliably detect the aggregate movement of sensitive information.

Breaches seen in the wild

• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.
• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow AI is now an NHI governance problem, not just an AI policy problem. The article makes clear that the issue is not employee intent but runtime access by tools and agents that behave like non-human actors. That means the governance boundary has shifted from acceptable use to lifecycle control over access, data handling, and inventory. Practitioners should treat AI agents as governed identities whose behaviour must be continuously observed.

Approval workflows alone cannot keep pace with AI tool velocity. Security teams are still using change-management cycles that were designed for slower software adoption, while AI tools ship new capabilities and integrations continuously. That gap creates governance debt: approved tools can become unreviewed risk surfaces after the original review. Practitioners should revalidate approved AI tools as dynamic services, not static exceptions.

Data-layer enforcement is the decisive control because destination controls miss the real path. If an AI tool can access the file system, model endpoints, and internal APIs in one session, blocking one destination does not govern the interaction. The control question is who or what can move which data, under what runtime conditions. Practitioners should redesign enforcement around data flows, not just approved applications.

Shadow AI visibility gap is the failure mode that matters most. The article’s most important point is that organisations cannot govern what they cannot see, and point-in-time audits do not create operational visibility. The right response is continuous discovery tied to data lineage and runtime policy enforcement. For practitioners, that means replacing static approvals with a living inventory of AI use.

Agentic tools collapse the old distinction between user action and system action. Once a tool acts autonomously, the human user is no longer the only accountable actor in the access path. That complicates ownership, offboarding, and review because the system can keep operating after the user’s decision moment has passed. Practitioners should map AI tools to the same governance discipline they use for other non-human identities, but with tighter runtime observability.

From our research library:

• 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
• Read next: Shadow AI and AI Agent Discovery Guide

What this signals

Shadow AI governance debt is accumulating because many enterprises still rely on approved-tool lists that age out faster than AI capabilities change. A static approval model cannot keep up with weekly product releases, agentic features, and new integrations, so the programme eventually governs a tool that no longer exists in practice.

The practical shift for security teams is toward continuous discovery and data lineage, not better awareness training. When AI systems can operate across endpoints and APIs, the programme has to see the session, not just the policy.

The broader market signal is that AI governance decisions are moving out of the executive suite and into infrastructure operations. According to the 2026 Infrastructure Identity Survey, 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite.

For practitioners

• Implement continuous AI tool discovery Track browser-based tools, locally installed agents, and MCP-connected services across managed and unmanaged endpoints so governance is based on runtime reality, not procurement records.
• Move enforcement to the data layer Control access based on what data an AI tool can read, prompt, or export, instead of depending only on destination blocks and approved application lists.
• Classify AI agents as governed non-human actors Assign ownership, review cadence, and access boundaries to autonomous tools so they are managed like other non-human identities with operational privileges.
• Reassess approved tools after capability changes Revalidate any AI application that adds agentic features, external API calls, or new integrations after approval, because point-in-time assessment does not govern behaviour over time.
• Differentiate low-risk and high-risk AI use Allow routine AI usage where no sensitive data is present, but escalate sessions that touch customer records, contracts, or internal repositories for review or restriction.

Key takeaways

• Shadow AI persists because policy-based governance assumes human-initiated behaviour, while AI tools and agents can move data across endpoints and APIs outside that model.
• The most important control failure is visibility, because organisations cannot govern AI interactions they cannot continuously observe.
• Practitioners should shift from awareness campaigns to runtime discovery, data-layer enforcement, and lifecycle control for autonomous tools.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It is built for practitioners who need to govern non-human access as part of a broader identity programme.