Notifications
Clear all
Topic starter
20/08/2026 5:49 pm
TL;DR: Shadow AI is letting employees move sensitive data into GenAI tools through copy-paste, browser apps, and SaaS integrations that traditional DLP often misses, according to Strac. The governance gap is not just visibility but control over prompts, OAuth connections, and real-time redaction before data leaves the environment.
NHIMG editorial — based on content published by Strac: The Invisible Data Leak From Shadow AI and GenAI Tools
Questions worth separating out
Q: How should security teams govern shadow AI without blocking business productivity?
A: Start by identifying the identities and credentials behind AI use, then classify each one by data sensitivity, connected systems, and business purpose.
Q: Why do AI systems create identity risk as well as model risk?
A: Because AI systems rarely act alone.
Q: What do organisations get wrong about DLP for AI use cases?
A: They assume keyword matching can distinguish legitimate work from sensitive exfiltration.
Practitioner guidance
- Implement browser-level prompt inspection Inspect prompts and file uploads in the browser so sensitive data can be detected before it reaches external AI models.
- Audit OAuth permissions for AI-connected apps Inventory every AI app that connects to email, files, CRM, or collaboration platforms through OAuth.
- Classify sensitive content for GenAI policy enforcement Tag customer data, source code, internal strategy, and regulated records so prompt controls can block or redact them in real time.
What's in the full article
Strac's full article covers the operational detail this post intentionally leaves for the source:
- How its Shadow AI detection methods identify unmanaged tools across browser and SaaS environments
- Which prompt inspection and redaction workflows it uses to stop sensitive data before model submission
- How it scores risk across connected AI apps so teams can prioritise the highest-exposure integrations
- The specific visibility indicators it uses to show which users are interacting with GenAI tools most often
👉 Read Strac's analysis of Shadow AI data leaks and GenAI protection →
Shadow AI data leaks: are your DLP controls keeping up?
Explore further
20/08/2026 6:28 pm
Shadow AI is becoming a data governance issue before it becomes an AI governance issue. The first practical failure is visibility, because most organisations cannot inventory the tools employees use or the permissions those tools inherit. That aligns with the broader NHI problem of unmanaged delegated access. Practitioners should treat AI app discovery and prompt governance as part of the same control objective.
A question worth separating out:
Q: Who is accountable when shadow AI uses corporate credentials to process sensitive data?
A: Accountability sits with the identity owners, the platform owners, and the governance function that approved the underlying access. If a service account or OAuth app can reach regulated data and an AI feature uses that path, the organisation is responsible for the resulting exposure and audit trail.
👉 Read our full editorial: Shadow AI data leaks expose the limits of traditional DLP
