Topic starter
10/07/2026 9:10 pm
TL;DR: Nearly 90% of organisations now use AI in at least one business function, while only 22% rely exclusively on employer-provided tools and nearly two-thirds lack the policies needed to detect or manage shadow AI, according to Zero Networks. The governance gap is now broader than visibility alone: unsanctioned AI creates access paths, lateral movement risk, and compliance exposure that conventional controls were not built to cover.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “Securing Shadow AI: How to Detect and Govern Unsanctioned AI Tools”.
By the numbers:
- Nearly 90% of organisations now use AI in at least one business function.
- Only 22% of individuals rely exclusively on tools provided by their employers.
Key questions
Q: What breaks when organisations cannot see shadow AI usage?
A: When shadow AI is invisible, security teams lose control over where data is sent, which assistants are connected, and whether those systems can retain or expose sensitive information.
Q: Why do unsanctioned AI tools increase lateral movement risk?
A: Unsanctioned AI tools often sit inside trusted networks while connecting to APIs, internal systems, and external services with more reach than their stated purpose requires.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Inventory AI connections continuously Map every AI-related identity, destination, and integration from observed traffic rather than relying on declared tool lists or project registers.
- Block unapproved SaaS AI destinations Define an approved list of AI services and deny connections to any SaaS AI destination outside that list across users, devices, and workloads.
- Scope agent permissions to task need Review each AI agent for what it can reach across CRM, production systems, and external APIs, then reduce permissions to the narrowest operational requirement.
Bottom line: Shadow AI is a governance failure as much as a discovery failure, because unsanctioned tools can create persistent access paths without formal approval.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:34 pm
Shadow AI is now an identity governance problem, not just a discovery problem. The article shows that unsanctioned AI creates access paths, not only unknown applications. Once AI tools and agents can touch data, APIs, and internal systems, governance has to track who or what is allowed to connect, under what approval, and with what revocation path. Practitioners should treat shadow AI as an entitlement issue that extends beyond inventory.
A few things that frame the scale:
- Organisations with high levels of shadow AI faced an average of $670,000 in additional breach costs compared with those with little or none, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: How should teams respond when AI is embedded in a sanctioned business tool?
A: Treat it as a governance change, not just a product feature. Review data handling, retention, approval boundaries, and ownership before broad rollout, and make sure the embedded AI path is visible in audit logs and identity records.
👉 Read our full editorial: Shadow AI outpaces governance as unsanctioned tools spread