Topic starter
25/06/2026 12:40 am
TL;DR: Shadow AI is widening governance and visibility gaps as 44% of AI-using organisations report business units deploying AI without IT or security involvement, according to Delinea’s 2025 AI in Identity Security report. The central issue is not just unsanctioned tool use, but identity controls that do not reliably cover AI entities, agent access, and machine identity lifecycle management.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Shadow AI risk: Navigating the growing threat of ungoverned AI adoption”.
By the numbers:
- 44% of organisations with at least some AI usage struggle with business units deploying AI solutions without involving IT and security teams.
- Only 61% of organisations claim to have full visibility into all machine identities for monitoring compromise.
- Only 52% of global organisations claim to have comprehensive controls in place.
Key questions
Q: What breaks when shadow AI is not included in identity governance?
A: When shadow AI is excluded, the organisation loses discovery, ownership, and enforcement at the same time.
A: Shadow AI is riskier because data is often entered through a prompt and ingested instantly, which can create immediate and sometimes irreversible exposure.
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped.
Practitioner guidance
- Inventory unsanctioned AI tools and their backing identities Build a discovery process that finds AI services, embedded copilots, agentic tools, and the tokens or accounts they use.
- Require identity governance for AI entities Place AI entities into the same governance workflow used for other non-human identities, including ownership, approval, periodic review, and retirement.
- Enforce access controls at the point of AI use Limit which data sources, APIs, and operational systems AI tools can reach, and scope those permissions to the narrowest practical business need.
Bottom line: Shadow AI exposes a gap between AI adoption and the identity controls needed to govern who or what is using data and systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:37 am
Shadow AI is first and foremost an identity governance problem, not just a policy problem. Once a business unit can adopt AI outside the approved control path, the organisation loses reliable ownership of the access created by that adoption. That weakens inventory, approval, review, and retirement processes at the same time, which is why shadow AI belongs inside IAM and IGA programme design, not beside it.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern agentic AI as it moves into production?
A: Security teams should govern agentic AI as a class of non-human identity, not as a generic application feature. That means assigning ownership, scoping permissions tightly, logging every tool action, and revoking access on a defined lifecycle. Production rollout should require clear approval points for high-risk actions and continuous monitoring for drift.
👉 Read our full editorial: Shadow AI governance gaps are exposing machine identity risk