TL;DR: Shadow AI is emerging inside both unsanctioned tools and approved SaaS copilots, expanding data flow beyond IT visibility and creating leakage, compliance, and retention risks, according to Valence Security. The core issue is not AI adoption itself, but the governance gap between how employees use AI and how existing SaaS controls were designed to manage it.
At a glance
What this is: This is an analysis of how Shadow AI is entering enterprises through both unsanctioned GenAI tools and AI features embedded in approved SaaS, with the key finding that existing SaaS controls are missing the resulting data-flow and governance gaps.
Why it matters: It matters because IAM, IGA, and security teams now have to govern sanctioned and unsanctioned AI usage without relying on visibility models that were built for static SaaS applications.
Context
Shadow AI is a governance problem, not just an adoption trend. In this context, it means employees are using generative AI outside approved guardrails or through AI features embedded in SaaS, while existing control sets still assume the application boundary is stable and visible.
That assumption breaks when AI can be accessed through personal accounts, built-in copilots, and hidden integrations. The result is data movement that security teams may not see in the same way they see traditional SaaS sprawl, which changes the governance problem for both enterprise software and identity programmes.
Key questions
Q: What breaks when shadow AI is treated as ordinary SaaS sprawl?
A: Teams miss the real control problem, which is not the app itself but the data it can access and the identities it uses. Shadow AI can transform, summarise, and share sensitive information in ways traditional inventories do not capture, so an app-centric model understates exposure and delays remediation.
A: Shadow AI is riskier because data is often entered through a prompt and ingested instantly, which can create immediate and sometimes irreversible exposure. Unlike a typical unsanctioned app, a consumer AI tool may retain inputs, lack a BAA, and bypass traditional network-based monitoring when users paste data locally or use desktop clients.
Q: What are the signs that SaaS and AI governance is breaking down in a customer environment?
A: Common warning signs include fragmented oversight across teams, unclear stakeholder ownership, difficulty tracking access after role changes, and rising spend without a matching business case. If customers cannot quickly answer who uses each tool, who approved it, and who pays for it, governance is already lagging. Visibility gaps usually show up before formal control failures do.
Q: How should organisations govern embedded AI features inside SaaS apps?
A: Treat embedded AI as a runtime governance problem, not just a procurement issue. Require visibility into feature activation, tie each capability to data classification rules, and re-review the app when a vendor adds new AI processing. If the feature can change what leaves the application, it needs continuous control.
Technical breakdown
Why SaaS security controls miss embedded AI copilots
SaaS security posture management was built to inventory apps, manage configuration, and reduce exposure across known services. Shadow AI changes the control surface because the AI capability may sit inside an approved platform such as a workspace suite or messaging app, so the tenant looks familiar even as prompt-based data flows expand. That means the unit of risk is no longer just the SaaS application. It is the combination of user, prompt, data class, and downstream model handling, which traditional SaaS controls do not model well.
Practical implication: extend discovery and policy enforcement to AI-enabled features, not only to standalone SaaS applications.
Why unsanctioned GenAI use creates retention and compliance risk
When users paste source code, customer records, contracts, or HR data into external GenAI tools, the organisation loses practical control over how that data is retained, reused, or exposed through future prompts and outputs. The article’s point is not that every tool behaves the same way, but that the enterprise cannot rely on the same deletion and logging assumptions it uses for normal SaaS. In governance terms, the data leaves a controlled system and enters an opaque processing environment with unclear retention boundaries.
Practical implication: classify what data may enter GenAI tools and enforce that policy with controls, not guidance alone.
How hidden AI use changes identity and access governance
Shadow AI often appears through approved identity paths, such as personal accounts, embedded copilots, or third-party SaaS integrations. That makes identity governance harder because the access may be legitimate at sign-in but illegitimate in context: the user is authorized to use the app, yet not authorized to send the data class being processed. This is where IAM and IGA need to converge with AI governance, because the meaningful question is no longer only who has access, but what they can disclose through that access.
Practical implication: apply contextual access policies that bind identity, application, and data sensitivity together.
Breaches seen in the wild
- Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.
- OmniGPT breach claim 2025: A hacker claims to have leaked 34 million OmniGPT AI chat messages holding users' API keys and credentials; OmniGPT has not confirmed it.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Shadow AI creates a governance gap because SaaS inventory is no longer the control boundary. The article shows that organisations are dealing with both standalone GenAI tools and AI layers inside approved applications, which means the old assumption of a visible, discrete SaaS estate is already broken. For practitioners, the important shift is that discovery must now include embedded AI functionality, not just separately purchased apps.
Prompt-level data movement is the new exposure path. Traditional SaaS security concentrated on accounts, configuration, and file sharing, but Shadow AI moves the risk into what users choose to paste, upload, or ask a model to infer. That makes data classification, prompt governance, and acceptable-use policy inseparable from identity governance. The implication is that control design has to follow the data path, not the application label.
AI inside SaaS turns approved identity into unapproved behaviour. A user may authenticate to a sanctioned workspace or collaboration platform, yet still route sensitive material into a model with different retention and training assumptions. That is why the problem sits at the intersection of IAM, SaaS security, and AI governance rather than in any single control domain. Practitioners should treat embedded AI features as a distinct governance surface.
Shadow AI is the modern expression of shadow IT, but with higher governance stakes. Shadow IT primarily created visibility and support problems; Shadow AI adds data retention uncertainty, compliance exposure, and a wider blast radius for sensitive content. The key concept here is governed AI visibility gap: organisations can see the application but not the AI-mediated data behaviour inside it. Security teams need to treat that gap as a standing programme issue, not a one-off exception.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 76% of organisations cite shadow AI as a definite or probable problem, up from 61% in 2025, according to HiddenLayer's 2026 AI Threat Landscape Report.
- Read next: Shadow AI and AI Agent Discovery Guide
What this signals
Governance teams now need AI visibility layered on top of SaaS discovery. The operating assumption that an approved app is a sufficiently bounded environment no longer holds when copilots and embedded models can move data out of the normal review path. Practitioners should expect their control model to shift from application inventories toward data-path governance and prompt-aware policy enforcement.
Shadow AI will force identity programmes to widen their scope. A user can authenticate correctly and still create an unmanaged exposure by using AI functionality in ways the organisation did not authorise. That means IAM and IGA teams need to work with SaaS security and data governance so access decisions reflect both the identity and the AI behaviour attached to it.
For practitioners
- Expand discovery to embedded AI features Inventory copilots and AI functions inside approved SaaS platforms, not only standalone GenAI tools, so visibility matches the actual data-flow surface.
- Classify data before AI use Define which data types may be shared with external AI systems and treat source code, customer records, and HR data as explicit policy categories.
- Bind AI use to contextual access policy Use identity, app, and data sensitivity together when deciding whether a prompt or upload is acceptable, especially in collaboration and workspace tools.
- Provide sanctioned AI pathways Offer approved AI tools and usage patterns so employees are less likely to route sensitive work through unmanaged personal accounts.
- Review retention and logging assumptions Test whether your current SaaS logging, audit, and deletion model still makes sense when data is processed by external GenAI services.
Key takeaways
- Shadow AI is not just another SaaS sprawl problem because it changes how data moves, persists, and escapes organisational control.
- The article argues that embedded copilots and unsanctioned GenAI tools create a visibility gap that existing SaaS controls do not cover.
- Practitioners need discovery, classification, and policy enforcement that address prompts, uploads, and AI-enabled features rather than application inventory alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | Shadow AI here is driven by employees using AI tools and embedded copilots with corporate data. |
| NHI-03 — Vulnerable Third-Party NHI | External AI services and integrations act like third-party non-human access paths. | |
| Recommendation — Restrict human-mediated AI use paths that can move sensitive data into unmanaged services. Review third-party AI integrations for data retention, access scope, and offboarding gaps. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about what users and AI features are authorized to do with data. |
| PR.DS-10 — Data-in-Transit is Protected | Shadow AI changes where data travels and where it can be exposed outside controlled systems. | |
| Recommendation — Align permissions and entitlements with AI usage policy so access reflects data sensitivity and context. Protect sensitive data as it moves into external AI services and embedded copilots. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The article describes data leaving enterprise control through AI-assisted workflows. |
| Recommendation — Map AI-driven data loss scenarios to credential access and exfiltration paths in your detection models. | ||
Key terms
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Enterprise AI Copilot: An Enterprise AI Copilot is an assistant embedded in business workflows that helps users draft, search, analyse, or act on information. In security terms, it becomes a governance problem when the copilot can trigger actions, access systems, or handle sensitive data through delegated permissions and connected tools.
- Prompt Governance: Prompt governance is the set of controls used to manage who can create, edit, approve, and roll back prompts in a live AI system. It treats prompts as change-controlled artefacts because small text changes can materially alter model behaviour, data exposure, and tool use.
- Data Path Governance: The discipline of tracking where sensitive data enters, moves through, and leaves a GenAI workflow. It includes prompts, caches, vector stores, logs, and downstream outputs, because each stage can create retention, disclosure, or policy drift if the control model is incomplete.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on May 28, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org