Topic starter
02/08/2026 12:30 pm
TL;DR: More than 80% of studied organisations showed signs of shadow AI activity, according to XM Cyber research, while Microsoft reported 78% of AI users bring their own tools and IBM said one in five organisations has already suffered a shadow AI-linked breach. The governance gap is no longer visibility alone, but control over unmanaged AI use, credentials, and data flow.
Editorial analysis by NHI Mgmt Group, based on content published by XM Cyber: “Shadow AI is Everywhere: XM Cyber Finds 80% of Companies Show Signs of Unapproved AI Activity”.
Key questions
Q: What breaks when organisations cannot see shadow AI usage?
A: When shadow AI is invisible, security teams lose control over where data is sent, which assistants are connected, and whether those systems can retain or expose sensitive information.
Q: Why does shadow AI increase cloud security risk so quickly?
A: Shadow AI increases risk because employees often connect external tools to sensitive data and permissions to get work done faster.
Q: What are the signs that AI tool usage is outside governance?
A: Look for repeated calls to AI endpoints from unmanaged devices, local processes tied to MCP servers, newly active OAuth tokens, and browser or desktop extensions that have not been reviewed.
Practitioner guidance
- Map shadow AI discovery to endpoint and browser telemetry Correlate browser history, endpoint artefacts, and sanctioned application inventories to identify unmanaged AI use that network DLP cannot see.
- Inventory MCP servers and exposed AI credentials Look for API keys, tokens, and other secrets stored in MCP configuration files, shared repositories, and synced development workspaces.
- Classify AI services as governed access paths Treat every external AI service or AI-enabled application as a distinct access path with an owner, approved purpose, and review cycle.
Bottom line: Shadow AI creates a governance blind spot because users can move sensitive data and machine credentials into AI tools outside approved identity and monitoring controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:28 pm
Shadow AI is now an access-governance problem, not just an application-discovery problem. Visibility matters, but the more material issue is that employees can create data and identity flows outside approved onboarding, entitlement review, and secret handling processes. Once AI use is unmanaged, the organisation no longer knows which identities, tokens, or data paths are participating in business activity. Practitioners should treat unmanaged AI as a governance boundary failure, not a niche tooling gap.
A few things that frame the scale:
- Organisations with high levels of shadow AI faced an average of $670,000 in additional breach costs compared with those with little or none, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: How should security teams govern shadow AI without blocking productivity?
A: Use visibility-based controls instead of blanket bans. Identify which tools are in use, who is using them, and what data they can access, then apply targeted policies by role and data sensitivity. That approach preserves legitimate AI adoption while reducing exposure from unsanctioned tools and unreviewed data paths.
👉 Read our full editorial: Shadow AI is exposing enterprise data and credentials at scale