Topic starter
02/08/2026 11:32 am
TL;DR: Shadow AI is spreading through personal accounts, unapproved browser extensions, API integrations, and autonomous agents that can access enterprise data and systems outside approved governance, according to Akto. The core issue is inventory and control gap, not just data leakage, because AI actions can hide inside normal user activity and bypass traditional discovery.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “Shadow AI Risks in Enterprises: Detection, Governance & Security”.
By the numbers:
- More than 80% of workers use unapproved AI tools, according to Akto.
- Only 37% of organisations have a documented AI governance policy, according to Akto.
- Around 69% of organisations either do not monitor AI usage or address it only reactively, according to Akto.
Key questions
Q: Where does shadow AI governance fail first in enterprises?
A: It usually fails first at discovery.
Q: Why is shadow AI harder to manage than ordinary shadow IT?
A: Shadow AI is harder because the tools can process sensitive content as part of normal use, which creates both data exposure and compliance risk.
Q: What are the signs that shadow AI agents are escaping discovery controls?
A: Common signs include identity traces without formal registration, endpoint-level activity from local agents or MCP servers, and broad permissions with no clear owner.
Practitioner guidance
- Build a complete AI tool and agent inventory Map approved, tolerated, and prohibited AI tools across browsers, SaaS apps, extensions, local models, and agents, then assign an owner and data classification to each entry.
- Revoke unmanaged personal-account access paths Block or step up controls for personal AI accounts, unmanaged browser extensions, and unsanctioned OAuth grants that can move enterprise data outside policy.
- Separate AI permissions from ordinary SaaS approval Reassess SaaS products whenever copilot features, embedded assistants, or data-processing terms change so that AI functions receive their own review.
Bottom line: Shadow AI becomes dangerous when normal user workflows hide AI tools, agents, and data flows from governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:46 pm
Shadow AI is an inventory failure before it is a policy failure. Security teams cannot govern what they cannot see, and the article’s examples show that AI use often sits inside personal accounts, browser sessions, or embedded SaaS features. That makes discovery the foundational control, not a supporting one. The practical conclusion is that governance programmes must begin with continuous AI inventory and ownership mapping.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat AI pentesting agents like non-human identities?
A: Yes. If an agent can authenticate, browse, test, and interact with systems, it has an authority boundary that should be governed like any other non-human identity. That means ownership, least privilege, explicit scope, isolation, and revocation controls. The difference is that these controls must be runtime-enforced, not assumed from policy.
👉 Read our full editorial: Shadow AI governance is failing faster than enterprise controls