Notifications
Clear all
Topic starter
02/08/2026 11:33 am
TL;DR: Gartner’s Shadow AI Is Creating Opportunity for Product Leaders report says more than 60% of enterprise employees now use unsanctioned AI tools and 35% of organizations have detected AI agents reaching external servers, widening governance gaps across data, access, and review, according to Akto’s summary of the report. Shadow AI has shifted from visibility problem to control problem, and discovery only matters when it is tied to policy enforcement and validation.
NHIMG editorial — based on content published by Akto: Akto Recognized as an Shadow AI Discovery Vendor in Gartner’s Shadow AI Is Creating Opportunity for Product Leaders report
By the numbers:
- More than 60% of enterprise employees now run unsanctioned AI tools without oversight.
- 35% of organizations have already detected AI agents reaching external servers and slipping past the perimeter.
- 79% of employees misuse approved public generative AI tools, 69% use prohibited tools outright, and 52% are building custom AI solutions with no security review.
Questions worth separating out
Q: How should security teams govern shadow AI without blocking productivity?
A: Use visibility-based controls instead of blanket bans.
Q: Why does shadow AI create an identity governance problem?
A: Shadow AI creates an identity governance problem because unapproved tools and agents can access enterprise data without being inventoried, owned, or recertified.
Q: What do security teams get wrong about AI exploit discovery?
A: Teams often assume exploit discovery remains a scarce human activity, but the article shows machine-speed discovery and chaining across real software surfaces.
Practitioner guidance
- Implement governed discovery for shadow AI Build an inventory of approved and unapproved AI tools, embedded assistants, and agentic workflows, then tie each entry to an owner, business purpose, and access scope.
- Route agentic workflows through policy gateways Place external model calls, tool use, and agent actions behind a gateway that can enforce action catalogs, least-privilege scope, and automatic redaction of sensitive fields before data leaves the boundary.
- Treat AI identities like lifecycle-managed access objects Record AI agents, service accounts, tokens, and delegated integrations in the same lifecycle process used for other high-risk identities, including ownership, review cadence, and revocation when the workflow changes.
What's in the full article
Akto's full article covers the operational detail this post intentionally leaves for the source:
- How the report maps shadow AI exposure into executive-level metrics that product and security leaders can use for prioritisation.
- The specific discovery, redaction, and gateway workflow the vendor describes for governing AI agents and external LLM calls.
- How the vendor positions continuous probes across LLM, agentic, and MCP attack surfaces inside the SDLC.
- The report's framing of AI governance as a board-level product and security issue, not just an engineering concern.
👉 Read Akto's analysis of Gartner's shadow AI discovery findings →
Shadow AI discovery and governance gaps: are your controls keeping up?
Explore further
02/08/2026 12:47 pm
Shadow AI discovery is becoming a governance control, not a reporting feature. The market language still treats discovery as a visibility layer, but the operational need is broader. Discovery only matters when it drives policy enforcement, redaction, and ownership assignment across human and non-human identities. That shifts shadow AI from an IT inventory problem to an identity governance issue. Practitioners should treat every discovered AI workflow as an access decision waiting to be formalised.
A question worth separating out:
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped. If those four things are missing, the programme has policy language but not operational control. Auditors will notice the gap quickly.
👉 Read our full editorial: Shadow AI discovery is becoming a board-level governance control
