Shadow AI is growing faster than visibility controls can keep up

TL;DR: Shadow AI is emerging as a data security problem rather than a simple application inventory issue, because employees are using copilots, agents, extensions, and AI apps that can directly retrieve, transform, and share sensitive information, according to BigID. The governance gap is now about visibility into AI activity, machine identities, and data context, not just policy enforcement.

NHIMG editorial — based on content published by BigID: Shadow AI changes the security equation

By the numbers:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.

Questions worth separating out

Q: What breaks when shadow AI is treated as ordinary SaaS sprawl?

A: Teams miss the real control problem, which is not the app itself but the data it can access and the identities it uses.

Q: Why do machine identities increase shadow AI risk?

A: Machine identities often carry permissions that outlast a single user action and can be broader than the task requires.

Q: How do security teams know if AI governance is working?

A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.

Practitioner guidance

• Map AI access paths to identities and machine credentials Build an inventory that links each AI application, extension, or agent to the user, service account, token, or API key that enables access.
• Correlate AI telemetry with sensitive data classification Do not stop at discovering the tool.
• Reduce machine identity blast radius in AI workflows Apply least privilege to the underlying credentials used by copilots and agents, rotate secrets on a defined schedule, and remove broad inherited access from the AI execution path.

What's in the full article

BigID's full analysis covers the operational detail this post intentionally leaves for the source:

• How BigID discovers shadow AI activity across cloud, SaaS, and hybrid environments
• Which AI access and data exposure signals the platform prioritises for risk scoring
• How identity-aware monitoring is applied to machine identities behind AI workflows
• How governance workflows connect AI discovery to sensitive data exposure reduction

👉 Read BigID's analysis of shadow AI, data exposure, and machine identity risk →

Shadow AI is growing faster than visibility controls can keep up?

Explore further

View Full Forum →  |  NHI Foundation Course →