Shadow AI is exposing governance gaps in enterprise identity

At a glance

What this is: This is a governance analysis of shadow AI adoption and its security, compliance, and business impacts, with the key finding that unmanaged AI use is outpacing enterprise visibility and policy.

Why it matters: It matters because IAM, NHI, and human identity programmes now have to govern AI use that often enters through existing SaaS, employee habits, and unsanctioned tools before security teams can see it.

By the numbers:

• 8 in 10 office workers now use some form of public AI, often without their IT department’s knowledge or approval.
• By 2026, 70% of employee interactions with AI will occur through features embedded in existing, sanctioned SaaS applications.
• Enterprise traffic to AI applications increased by a staggering 595% between April 2023 and January 2024.
• Only 15% of organizations have updated their Acceptable Use Policies (AUPs) to include specific guidelines on AI.

👉 Read JumpCloud's 2026 shadow AI report for the full survey findings

Context

Shadow AI is the unsanctioned use of AI tools by employees, and it creates an identity governance problem because access now arrives through tools that are not fully inventoried, approved, or controlled. The primary issue is not that AI is everywhere, but that usage often bypasses the identity, data, and policy checkpoints that IAM and security teams rely on to manage risk.

The article frames a familiar pattern in a new form. Employees adopt tools faster than procurement, security review, and acceptable use policies can keep up, which leaves organisations with partial visibility into who is using AI, what data is flowing to it, and which controls apply. That makes shadow AI a programme issue for human identity governance, SaaS access control, and data protection at the same time.

Key questions

Q: How should security teams govern shadow AI without blocking all employee use?

A: Start by discovering where AI already appears in sanctioned SaaS, browsers, and public tools, then apply policy to the specific data flows and identities involved. The goal is not blanket prohibition. It is to make approved use visible, define what data can be shared, and give employees secure alternatives for common tasks.

Q: Why do unsanctioned AI tools create compliance risk for IAM teams?

A: They move employee data into third-party systems that may sit outside approved access, logging, and retention controls. IAM teams are affected because identity determines who can submit data, from which device, and under what policy. When those conditions are unclear, compliance, auditability, and accountability all weaken at the same time.

Q: What do organisations get wrong about acceptable use policies for AI?

A: They often treat acceptable use as a document instead of a control. If the policy is not tied to identity provider rules, device trust, and approved application access, it will not change behaviour. For AI, the policy must be operationalised through enforcement points, or employees will continue using whatever is easiest.

Q: How do security teams know if shadow AI governance is working?

A: Look for reduced use of unsanctioned tools, better visibility into AI data flows, and more employee traffic moving through approved applications. If incidents are still difficult to trace or employees keep finding external tools for common work, governance has not yet reached the operational layer.

Technical breakdown

Why shadow AI bypasses traditional access governance

Shadow AI often enters the enterprise through browser sessions, embedded SaaS features, and employee-chosen public tools rather than through centrally approved applications. That matters because classic access governance assumes systems are known, provisioned, and policy-bound before use. Once AI is consumed as a feature inside existing software, the control point shifts from application approval to data-flow oversight, entitlement review, and usage visibility. Security teams lose the clean boundary they are used to seeing in app inventories and SSO logs. Practical implication: govern AI use through identity, SaaS, and data controls together, not as a standalone application problem.

Practical implication: inventory AI entry points inside sanctioned SaaS before trying to block standalone tools.

How data exposure happens through unsanctioned AI use

The exposure risk comes from employees sending prompts, files, or operational context to third-party AI models that sit outside enterprise policy. Even when the tool seems harmless, the act of submission can move regulated, confidential, or proprietary data into environments the organisation cannot fully audit. That is why visibility into data movement matters more than simple allow or deny lists. The article also points to slower incident handling because tracing these flows across vendors and integrated services is difficult. Practical implication: treat AI prompts and outputs as data pathways that require monitoring, classification, and incident ownership.

Practical implication: classify prompt and output flows as governed data paths, then log and review them like other sensitive transfers.

Why acceptability policy is now an identity control

Acceptable use policy is no longer just a conduct document when employees can access AI tools instantly and outside procurement. It becomes an operational control that defines which identities may use which AI services, under what conditions, and with what data. In practice, that links policy to identity provider rules, device posture, and approved application lists. Without those ties, policy remains a statement of intent rather than a control surface. Practical implication: align AI usage rules with identity enforcement so policy can be applied, not just published.

Practical implication: tie AI rules to identity and device enforcement so the policy has operational effect.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• DeepSeek breach — DeepSeek breach exposed 1M+ log lines and sensitive secret keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow AI is an identity governance problem before it is a technology problem. The article shows employees adopting AI outside sanctioned workflows, which means the organisation cannot reliably assert who is using what, through which account, or with which data. That is a governance failure because the control model depends on discovery and policy coverage, not just on user intent. The practical conclusion is that shadow AI should be managed as part of identity, SaaS, and data governance together.

Visibility debt is the specific failure mode shadow AI exposes. The enterprise cannot govern what it does not discover, and the article shows discovery is collapsing under embedded AI features and unsanctioned tools. Once AI shows up inside approved applications, a simple app inventory no longer reveals the real access surface. Practitioners should treat this as a structural visibility gap, not a one-off policy lapse.

Acceptable use policy is only effective when it is bound to enforcement. The article’s 15% policy update figure shows most organisations have not converted AI guidance into operational control. That leaves employees with permission ambiguity and security teams with weak authority over behaviour. The implication is that AI policy has to be expressed through identity, device, and application controls to matter in practice.

Shadow AI also signals unmet business demand, not just user misbehaviour. JumpCloud’s framing is that employees use these tools because they solve real workflow needs faster than approved alternatives do. That means banning tools alone will not shrink the problem for long. The practitioner conclusion is to pair governance with a curated, secure enablement model.

AI governance is converging with IAM, not sitting beside it. As AI interactions move into sanctioned SaaS and everyday employee workflows, identity teams become responsible for seeing and governing access patterns that do not look like traditional application onboarding. That shift pulls AI policy into the same operational lane as human identity, access reviews, and device trust. Practitioners should plan for AI governance to become a standard IAM workload, not a side project.

From our research:

• 59.8% of organisations see value in a solution that simplifies non-human access management and introduces dynamic ephemeral credentials, according to The 2024 Non-Human Identity Security Report.
• Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
• For a broader baseline on NHI risk, see Ultimate Guide to NHIs , Why NHI Security Matters Now.

What this signals

Shadow AI will increasingly show up inside approved software rather than as obvious standalone tools, which means identity teams need to extend governance into SaaS feature usage, not just application onboarding. Visibility debt: the gap between what employees can access and what security teams can actually see will become the main operational constraint.

With 88.5% of organisations already acknowledging that their non-human IAM practices lag behind or are merely on par with human IAM, according to The 2024 Non-Human Identity Security Report, the lesson for AI governance is clear. The same maturity gap that affects workloads and service identities will surface again wherever AI access becomes embedded in business workflows.

Security teams should prepare for AI governance to be measured by discoverability, policy enforcement, and data-flow containment rather than by the number of tools banned. The organisations that make approved AI easy to use will reduce shadow adoption more effectively than those that rely on restriction alone.

For practitioners

• Inventory AI entry points across sanctioned SaaS Map where employees are already encountering AI inside approved applications, then separate those flows from standalone public tools so you can apply different controls to each path.
• Bind AI usage policy to enforceable identity controls Translate acceptable use rules into identity provider conditions, device posture checks, and approved application restrictions so the policy can actually shape behaviour.
• Classify prompt and output data flows Treat prompts, uploaded files, and model outputs as governed data movements, then define what can be sent, where it can go, and who owns the resulting telemetry.
• Create sanctioned alternatives for high-value use cases Work with business teams to identify the AI use cases driving shadow adoption, then provide approved tools that meet those needs without pushing users back to unsanctioned services.

Key takeaways

• Shadow AI is not just an employee behaviour issue, because it becomes a governance failure when identities, data flows, and policies are not aligned.
• The scale is already material, with public AI use, embedded SaaS features, and delayed incident handling all showing that visibility is trailing adoption.
• The practical response is to bind AI policy to enforceable identity controls and offer approved alternatives that meet the same business need.

Key terms

• Shadow AI: Unsanctioned use of AI tools, models, or AI-enabled features by employees outside approved procurement and security review. In practice, it creates untracked access paths, unclear data handling, and governance gaps that identity and security teams cannot control with ordinary application inventory alone.
• Acceptable Use Policy: A policy that sets the boundaries for how employees may use technology, data, and external services. For AI, it only becomes effective when linked to identity, device, and application enforcement, otherwise it remains guidance without operational control.
• Data flow governance: The discipline of defining, monitoring, and controlling how sensitive information moves between users, systems, and external services. For AI usage, it focuses on prompts, uploads, outputs, and retention so organisations can prevent data exposure and prove compliance.

Deepen your knowledge

Shadow AI governance belongs in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are trying to bring unmanaged AI use into a controlled identity programme, this is a practical place to start.

This post draws on content published by JumpCloud: The 2026 State of Shadow AI. Read the original.