Topic starter
16/01/2026 2:15 pm
TL;DR: Adoption of AI tools has become rapid, decentralized, and often invisible to security teams, creating shadow AI, expanded SaaS permissions, and data governance gaps across enterprise workflows, according to Wing Security. The governance problem is now about discovery, policy enforcement, and auditability before AI use outruns existing IAM and control models.
Editorial analysis by NHI Mgmt Group, based on content published by Wing Security: “Bringing Order to AI Chaos: The Case for AI Governance”.
Key questions
Q: What breaks when shadow AI is not discovered early?
A: Teams lose sight of which agents exist, what they can reach, and which credentials they use.
Q: Why do embedded AI agents increase enterprise risk so quickly?
A: Embedded agents widen the trust boundary because they add natural-language input, delegated tool access, and a reasoning layer inside software that was previously static.
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped.
Practitioner guidance
- Expand discovery to shadow AI and embedded AI Inventory employee-adopted AI tools, SaaS features that now include AI functions, and any integrations that can move corporate data into model workflows.
- Tie AI permissions to data exposure paths Document which datasets, files, and business systems each AI-enabled application can reach, including indirect access through APIs and connected services.
- Automate policy enforcement for unsafe AI use Block or restrict AI tools that request excessive access, lack vendor transparency, or introduce unapproved training and retention behaviour.
Bottom line: Shadow AI is widening the gap between approved identity controls and actual data use across enterprise stacks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:44 pm
Shadow AI is a governance visibility problem before it is an AI problem. The article shows that employees, SaaS vendors, and third-party integrations are introducing AI into production workflows faster than security teams can inventory it. That means the first failure is not misuse, but lack of authoritative discovery. The practical conclusion is that AI needs to be governed as a live identity and data surface, not as a one-time procurement decision.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations use AI in IAM without weakening governance?
A: Use AI for pattern detection, summarisation, and query generation, but keep access approval, role creation, and policy enforcement under human accountability. AI should accelerate evidence gathering, not replace the judgement needed to decide whether access is appropriate. If the input data is poor, treat the model output as advisory only.
👉 Read our full editorial: AI governance gaps are widening as shadow AI enters enterprise stacks