Notifications
Clear all
Topic starter
19/08/2026 3:30 pm
TL;DR: Most security teams still cannot answer where AI is running, what data it touches, or whether current controls can govern it, according to TruFoundry's analysis. That gap matters because shadow AI and agentic usage turn visibility, identity, and auditability into the deciding controls, not just another proxy layer.
NHIMG editorial — based on content published by TruFoundry: What security teams actually need from an AI gateway?
By the numbers:
- 20% of breached organizations were compromised through shadow AI, adding roughly $670,000 to the average breach cost.
- 97% of those organizations lacked proper access controls.
- 63% had no AI governance policy at all.
Questions worth separating out
Q: How should security teams govern AI in the security stack?
A: Security teams should treat AI as a governed decision aid, not an autonomous authority.
Q: Why does residual risk matter for NHI and IAM programmes?
A: Residual risk matters because identity controls often reduce, but do not eliminate, the reach of service accounts, tokens, OAuth grants, and privileged access.
Q: What do security teams get wrong about AI gateway deployment?
A: They assume visibility alone equals control.
Practitioner guidance
- Inventory every AI traffic path Classify developer-built apps, desktop tools, consumer web apps, and embedded SaaS AI separately, then assign the control that can actually enforce policy for each path.
- Bind AI activity to accountable identities Use scoped credentials, per-application tokens, and token exchange so the acting identity is preserved across chained calls.
- Separate discovery from enforcement Log prompts, responses, identity, and cost into one audit stream, then export that stream to your SIEM for reconstruction and compliance evidence.
What's in the full article
TruFoundry's full blog post covers the operational detail this post intentionally leaves for the source:
- Specific gateway deployment patterns for developer apps, desktop clients, consumer web apps, and SaaS-embedded AI features.
- Implementation detail on Virtual Account Tokens, device certificates, and token exchange across chained agent calls.
- Step-by-step guidance for integrating the gateway with MDM, SWG, SIEM, and endpoint controls.
- Practical examples of how MCP Gateway policy separates inbound authentication from outbound tool access.
👉 Read TruFoundry's full analysis of what security teams need from an AI gateway →
AI gateways and shadow AI governance: what teams need now?
Explore further
19/08/2026 4:13 pm
AI gateways are becoming the governance layer for shadow AI, not just the transport layer for model traffic. The article is strongest when it treats AI usage as an identity problem rather than a routing problem. Shadow AI becomes a control failure when security can neither inventory the actor nor bind its activity to policy. That means the gateway's value is measured by governance completeness, not latency or routing convenience.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How do organisations know whether an AI gateway is actually working?
A: Look for three signals at once: AI traffic is inventoried, identity is preserved through the call chain, and audit records are usable in incident response or compliance review. If any one of those is missing, the gateway is serving as a transport layer, not a governance control.
👉 Read our full editorial: What security teams actually need from an AI gateway
