Topic starter
08/06/2026 4:26 pm
TL;DR: IBM’s 2025 Cost of a Data Breach Report found that 20% of organisations discovered Shadow AI and 63% still had no AI governance policy, while AI-heavy security operations cut mean time to intervene by about 80 days and saved $1.9 million, according to Cyera. The governance problem is visibility plus access control, not AI adoption itself: without discovery, least privilege and auditability, AI tools become ungoverned data pathways.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “The Hidden Costs of Shadow AI: Why Access and Audit Controls Matter Now”.
By the numbers:
- 20% of organisations reported discovering Shadow AI in their environments.
- 63% of organisations have no AI governance policy in place.
- Extensive use of AI in security reduced mean time to intervene by about 80 days and saved organisations on average $1.9 million.
Key questions
Q: How should organisations govern shadow AI without blocking legitimate use?
A: Start with approved-use policy, tool inventory, and data classification.
Q: Why do role-based access controls struggle with AI tools?
A: RBAC is too coarse for AI because the same tool may need different data access depending on the user, the dataset and the business purpose.
Q: When do AI access controls fail in practice?
A: They fail when authorization happens after retrieval, when tool permissions are broad, or when response masking is treated as optional.
Practitioner guidance
- Map Shadow AI to governed identities Inventory approved and unapproved AI tools, name the business owner for each, and record which human identities and data sets they can reach.
- Separate tool access from data access Do not treat permission to use an AI application as permission for that application to access sensitive data.
- Use attribute-based policy for AI authorisation Apply attributes such as data sensitivity, purpose, user role and environment when deciding whether an AI tool may retrieve or process information.
Bottom line: Shadow AI is an access-control and audit problem as much as an AI adoption problem, because unmanaged tools can reach sensitive data outside formal governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/06/2026 6:04 pm
Shadow AI is an identity governance failure before it is an AI risk. The article correctly frames the issue around discovery, access and auditability rather than model novelty. If an AI tool is not inventoried, owned and tied to identity, the organisation cannot govern who can use it or what data it can touch. The practical conclusion is that AI must enter the identity lifecycle as a governed subject, not an informal productivity tool.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should security teams do when a third-party AI service can see sensitive data?
A: Treat the service like any other governed external identity. Confirm the data scope it needs, restrict access to that scope only, require logging, and review the arrangement whenever the service, dataset or business purpose changes. External AI without lifecycle control becomes an unmanaged data path.
👉 Read our full editorial: Shadow AI exposes a governance gap in AI access and audit controls