Notifications
Clear all
Topic starter
02/08/2026 11:47 am
TL;DR: Shadow AI is already widespread, with 55% of employees using AI at work without employer approval, creating models and integrations that operate outside audit, risk review, and compliance oversight, according to Openlayer. The governance problem is not only discovery but enforcement, because unregistered AI can process regulated data for months before controls catch up.
NHIMG editorial — based on content published by Openlayer: Governing Shadow AI in Your Organization (July 2026)
By the numbers:
- 55% of employees using AI at work are doing so without employer approval.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: What breaks when shadow AI is not included in identity governance?
A: When shadow AI is excluded, the organisation loses discovery, ownership, and enforcement at the same time.
Q: Why do shadow AI deployments create IAM and NHI risk?
A: Shadow AI creates IAM and NHI risk because it often appears before governance, then quietly inherits access to data, APIs, and secrets.
Q: How do security teams know whether AI access is actually working safely?
A: Look for three signals: complete discovery of the AI estate, clear mapping of source data to each system, and logs that prove what was accessed and why.
Practitioner guidance
- Build a single intake path for AI tools Route unregistered models, third-party AI APIs, and SaaS copilots through one intake process that checks data class, owner, and approval status before use begins.
- Correlate telemetry across network, finance, and access logs Combine API-call monitoring, expense anomalies, and behavioural signals such as bulk exports or unapproved notebook activity.
- Enforce runtime controls at the API boundary Block policy violations before inference outputs leave the system, and write an immutable record of model version, input context, and decision outcome for audit use.
What's in the full article
Openlayer's full article covers the operational detail this post intentionally leaves for the source:
- The article's detection-method breakdown for network, expense, and behavioural signals that surface shadow AI.
- The governance workflow for tiered approval routing and how low-risk tools move through self-certification.
- The runtime control examples for blocking unapproved inference and generating audit evidence at the API boundary.
- The detailed discussion of EU AI Act and NIST AI RMF evidence expectations for production systems.
👉 Read Openlayer's analysis of governing shadow AI in your organisation →
Shadow AI governance gaps: are your controls keeping up?
Explore further
02/08/2026 12:57 pm
Shadow AI is an identity governance problem before it is an AI governance problem. Once employees can stand up unapproved models or API integrations, the organisation has lost control of who or what is acting on its data. That makes the system identity of the AI tool just as important as the human user who invoked it. Practitioners should treat unregistered AI as an identity inventory failure, not only a policy exception.
A question worth separating out:
Q: Who is accountable when an AI agent accesses regulated data improperly?
A: Accountability sits with the teams that govern the agent's identity, the data classification, and the policy that allowed the access path. If those controls are disconnected, no single owner can explain why the access existed or why it was not removed sooner. Shared context is what makes accountability traceable.
👉 Read our full editorial: Shadow AI governance fails when employees outrun approval workflows
