Topic starter
02/08/2026 11:33 am
TL;DR: Gartner’s Shadow AI Is Creating Opportunity for Product Leaders report says more than 60% of enterprise employees now use unsanctioned AI tools and 35% of organizations have detected AI agents reaching external servers, widening governance gaps across data, access, and review, according to Akto’s summary of the report. Shadow AI has shifted from visibility problem to control problem, and discovery only matters when it is tied to policy enforcement and validation.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “Akto Recognized as an Shadow AI Discovery Vendor in Gartnerâ¢âs "Shadow AI Is Creating Opportunity for Product Leadersâ Report”.
By the numbers:
- More than 60% of enterprise employees now use unsanctioned AI tools, according to Akto’s summary of Gartner’s report.
- 35% of organisations have detected AI agents reaching external servers, according to Akto’s summary of Gartner’s report.
Key questions
Q: What breaks when shadow AI controls stop at visibility and do not include enforcement?
A: Visibility alone tells you that unsanctioned AI exists, but it does not prevent leaks.
Q: Why do unsanctioned AI tools create the same governance problems as shadow IT?
A: Unsanctioned AI use creates shadow IT risk because users often route around restrictions when a tool is blocked.
Q: How do security teams know if shadow AI is actually under control?
A: Security teams know shadow AI is under control when they can inventory every agent, model workflow, and tool connection, then map each one to an owner and access scope.
Practitioner guidance
- Implement continuous shadow AI discovery Scan internal environments, SaaS usage, and developer workflows for unsanctioned AI tools, external LLM calls, and hidden agent integrations.
- Bind AI usage to policy-enforced identity Require accountable identities for agents and AI-enabled workflows so access logs, privilege scopes, and approval states can be audited together.
- Route agents through governed gateways Force agentic workflows through central gateways that restrict tool access, enforce least privilege, and apply automatic redaction before data can reach external services.
Bottom line: Shadow AI is becoming a governance control problem because discovery without policy enforcement cannot stop data from moving into unsanctioned tools and agent workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:47 pm
Shadow AI discovery has become a governance control, not a visibility exercise. Once employees can route data into unsanctioned tools faster than security can review them, discovery alone is only an inventory function. The board-level question is whether discovery feeds enforcement, redaction, and identity-bound policy decisions. Without that chain, the organisation can measure exposure but cannot govern it.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between shadow IT and shadow AI?
A: Shadow IT is the use of unapproved software, while shadow AI is the use of unapproved or unmanaged generative AI services and embedded copilots. Shadow AI is harder to govern because it often hides inside sanctioned SaaS tools and can move data into external model systems without obvious signs.
👉 Read our full editorial: Shadow AI discovery is becoming a board-level governance control