Notifications
Clear all
Topic starter
02/08/2026 12:30 pm
TL;DR: More than 80% of studied organisations showed signs of shadow AI activity, according to XM Cyber research, while Microsoft reported 78% of AI users bring their own tools and IBM said one in five organisations has already suffered a shadow AI-linked breach. The governance gap is no longer visibility alone, but control over unmanaged AI use, credentials, and data flow.
NHIMG editorial — based on content published by XM Cyber: Shadow AI is exposing enterprise data and credentials at scale
By the numbers:
- 78% of AI users bring their own tools to the workplace.
- Nearly 60% of users rely on unmanaged AI apps.
- XM Cyber research found that more than 80% of the researched organisations showed signs of Shadow AI activity.
Questions worth separating out
Q: What breaks when employees use shadow AI for work tasks?
A: Shadow AI breaks identity visibility and lifecycle control.
Q: Why do shadow AI tools create more risk than sanctioned SaaS apps?
A: Shadow AI bypasses procurement, security review, and entitlement design, so it often enters with broad access and no clear accountability.
Q: How do security teams know if shadow AI is actually under control?
A: Security teams know shadow AI is under control when they can inventory every agent, model workflow, and tool connection, then map each one to an owner and access scope.
Practitioner guidance
- Implement continuous discovery for shadow AI usage Instrument endpoints, browsers, and proxy logs to identify unmanaged AI services, personal accounts, and AI-enabled applications in use across the organisation.
- Scan MCP configurations for embedded secrets Treat MCP server configuration files as secret-bearing artefacts and add them to routine scanning, rotation, and repository protection workflows.
- Bind AI use policy to enforceable controls Map acceptable-use rules to concrete controls such as identity-aware access policies, DLP enforcement, and device trust requirements.
What's in the full article
XM Cyber's full blog covers the operational detail this post intentionally leaves for the source:
- The article’s telemetry methods for identifying Shadow AI across browsers, endpoints, and managed versus unmanaged devices.
- The way MCP server configurations can expose API keys, tokens, and other credentials in development workflows.
- The vendor’s proposed expansion of continuous exposure management into AI services such as managed cloud AI platforms and MCP-connected devices.
- The compliance and measurement signals XM Cyber says practitioners should track as AI adoption increases.
👉 Read XM Cyber's analysis of Shadow AI exposure, visibility gaps, and credential leakage →
Shadow AI blind spots: what IAM and security teams need to know?
Explore further
02/08/2026 1:28 pm
Shadow AI is an identity-governance problem before it is an AI governance problem. The core failure is not simply that employees use unsanctioned tools, but that those tools sit outside access review, lifecycle control, and auditability. Once data, prompts, or secrets move through unmanaged accounts and browser sessions, governance teams lose the ability to answer who used what, with which identity, and under which policy. That makes Shadow AI a control-boundary issue across human identity, NHI exposure, and workload credentials, not just an acceptable-use issue.
A question worth separating out:
Q: Who is accountable when shadow AI uses corporate credentials to process sensitive data?
A: Accountability sits with the identity owners, the platform owners, and the governance function that approved the underlying access. If a service account or OAuth app can reach regulated data and an AI feature uses that path, the organisation is responsible for the resulting exposure and audit trail.
👉 Read our full editorial: Shadow AI is exposing enterprise data and credentials at scale
