Notifications
Clear all
Topic starter
02/08/2026 11:23 am
TL;DR: Shadow AI now spans agents, MCP servers and LLMs hidden on endpoints, in browsers and inside IDEs, so traditional shadow IT discovery models no longer catch the full attack surface, according to Akto. The governance problem is no longer finding web apps, but inventorying AI assets, their access and their actions before those assets become unreviewed identity sprawl.
NHIMG editorial — based on content published by Akto: Shadow AI in the Enterprise: Q&A with Akto CEO Ankita Gupta on Enterprise Security Weekly
Questions worth separating out
Q: How should security teams discover shadow AI agents in the enterprise?
A: Use endpoint artefacts first.
Q: Why do shadow AI tools complicate IAM governance?
A: Shadow AI tools complicate IAM because they can hold real privileges without appearing in normal inventory or review processes.
Q: What do teams get wrong about AI guardrails and identity controls?
A: They often assume a content filter is a substitute for access governance.
Practitioner guidance
- Build a complete AI asset inventory Map AI agents, MCP servers, LLM use and local copilots across the browser, IDE and endpoint so you know where shadow AI actually lives.
- Classify AI access by action, not just login Separate read, write, publish and delete capabilities for each AI asset and tie them to the systems they can reach.
- Introduce guardrails before broad enablement Start with alerting for prompt injection, malicious skills and sensitive-data exposure, then move to blocking where the business use case is clear.
What's in the full article
Akto's full Q&A covers the operational detail this post intentionally leaves for the source:
- Direct guidance on how enterprises are distinguishing discovery from enforcement across shadow AI assets
- The interview's practical examples of prompt injection, malicious skills and malicious MCP servers in real workflows
- How organisations are deciding whether to alert or block specific AI behaviours as they mature their controls
- The discussion of how ownership is consolidating under the CISO, CIO or dedicated AI governance teams
👉 Read Akto's Q&A on shadow AI discovery, guardrails and governance →
Shadow AI on the endpoint: what identity teams need to do now?
Explore further
02/08/2026 12:40 pm
Shadow AI is now an identity discovery problem, not just an application discovery problem. The article makes clear that AI assets live on the endpoint, in the IDE and behind browser sessions, which breaks the assumption that network-edge discovery is enough. That shifts the field toward continuous inventory of non-human identities across local and cloud execution points. Practitioners should stop treating AI visibility as a point-in-time scan and start treating it as a persistent governance requirement.
A question worth separating out:
Q: Who should own shadow AI risk in an organisation?
A: Shadow AI risk should be owned jointly by IAM, security operations, privacy, and compliance teams because the issue spans identity, data handling, and regulatory exposure. If ownership sits in only one function, the organisation usually gets either weak enforcement or weak accountability, but not both.
👉 Read our full editorial: Shadow AI discovery is failing across endpoints, browsers and IDEs
