Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: Shadow AI is no longer a fringe productivity habit. Anomali cites research showing that 98% of organisations have unverified applications in use and that unsanctioned AI tool usage has tripled in 12 months, turning employee AI adoption into a material data exposure problem. The governance gap is now larger than the policy gap, and conventional DLP is not built for it.
NHIMG editorial — based on content published by Anomali: Shadow AI in the Enterprise: Why Unapproved AI Tool Adoption Is Becoming a Systemic Data Governance Crisis
By the numbers:
- Unsanctioned AI tool usage tripled over 12 months, rising from 15% to 45% of the workforce.
- The average organization runs 10 AI applications per month, many outside formal approval processes.
- 69% of organizations either suspect or have direct evidence that employees are using prohibited public generative AI tools.
Questions worth separating out
Q: How should organisations govern AI usage when employees use unapproved tools?
A: Organisations should start with visibility, not enforcement.
Q: Why does shadow AI create risk even when there is no obvious external traffic?
A: Because many AI tools now run locally, inside IDE extensions, containers, or MCP-connected workflows that do not depend on a visible outbound session.
Q: What breaks when employees hide their AI tool usage?
A: Detection and governance both weaken.
Practitioner guidance
- Build a live AI application inventory Catalogue sanctioned and unsanctioned AI tools, the identities using them, and the data they process so governance starts from observed reality, not policy assumptions.
- Extend DLP to browser-based AI interactions Cover prompts, uploads, and embedded assistants with monitoring that can classify unstructured data in real time rather than relying only on email and endpoint controls.
- Bind AI use to identity and ownership controls Require owner assignment, access review, and offboarding for every approved AI service, including external LLM integrations and connected accounts.
What's in the full article
Anomali’s full article covers the operational detail this post intentionally leaves for the source:
- Survey citations and the underlying evidence trail behind the shadow AI adoption figures
- The specific exposure behaviors observed in prompts, uploads, and personal account use
- The vendor’s discussion of DLP limitations and AI-aware control models
- The linked references behind the regulatory and workforce claims
👉 Read Anomali’s analysis of shadow AI and systemic data governance risk →
Shadow AI in the enterprise: what governance teams are missing?
Explore further
14/09/2026 10:10 am
Shadow AI is best understood as an access governance failure, not just a data loss problem. When employees use unapproved AI tools, the enterprise loses control over where identities, prompts, and files are processed. That makes the issue broader than classic DLP because the hidden path is created by human identity choices and unmanaged application trust. For IAM and governance teams, the practical conclusion is that AI usage must be managed like any other access surface.
A question worth separating out:
Q: Should organisations prioritise AI inventory before blocking access to tools?
A: Yes. Inventory comes first because teams need to know which tools, accounts, and data flows are actually in use before they can decide what to block, approve, or monitor. A blind block often drives usage underground, while discovery creates the evidence needed for targeted policy and proportionate controls.
👉 Read our full editorial: Shadow AI is becoming a systemic data governance crisis
