Notifications
Clear all
Topic starter
02/08/2026 11:32 am
TL;DR: Shadow AI is spreading through personal accounts, unapproved browser extensions, API integrations, and autonomous agents that can access enterprise data and systems outside approved governance, according to Akto. The core issue is inventory and control gap, not just data leakage, because AI actions can hide inside normal user activity and bypass traditional discovery.
NHIMG editorial — based on content published by Akto: Shadow AI Risks in Enterprises, Detection, Governance & Security
By the numbers:
- More than 80% of workers use unapproved AI tools.
- Only 37% of organisations have a documented AI governance policy.
- 69% of organisations either do not monitor AI, not monitor AI usage or address it only reactively.
Questions worth separating out
Q: What breaks when employees use unapproved AI tools with company data?
A: Governance breaks because the organisation loses visibility into where data and secrets are going, who can access them, and how they are being reused.
Q: Why do shadow AI tools create identity governance risk?
A: Shadow AI is risky because users often reach those tools through identities, browser sessions, or tokens that were never assessed for data handling or access scope.
Q: How do security teams know if shadow AI is actually under control?
A: Security teams know shadow AI is under control when they can inventory every agent, model workflow, and tool connection, then map each one to an owner and access scope.
Practitioner guidance
- Define an approved AI tool registry Classify AI tools as approved, tolerated, or prohibited, then require business justification, data handling rules, and review ownership for each entry.
- Inventory AI connections and hidden permissions Discover OAuth grants, browser extensions, API keys, and integration accounts that can reach sensitive systems.
- Treat autonomous AI workflows as NHIs Assign ownership, scope, monitoring, and offboarding to any AI system that can call APIs or act in business workflows.
What's in the full article
Akto's full article covers the operational detail this post intentionally leaves for the source:
- A fuller breakdown of detection methods for browser-based Shadow AI and hidden extensions.
- Practical guidance on AI usage policies, governance workflows, and exception handling.
- Examples of how AI-approved SaaS features can create new data-processing risk.
- The article's discussion of zero trust for AI systems and runtime policy enforcement.
👉 Read Akto's analysis of Shadow AI risks, detection, and governance →
Shadow AI risks in enterprises: what IAM and security teams need to do?
Explore further
02/08/2026 12:46 pm
Shadow AI is becoming an identity governance problem, not just a data governance problem. The article correctly shows that the real control gap is not only where data goes, but who or what is allowed to act in the enterprise under AI-mediated workflows. Once an AI tool can authenticate, invoke APIs, or operate through a user’s credentials, it behaves like a non-human identity that needs ownership, scope, and lifecycle controls. Practitioners should stop treating this as a peripheral acceptable-use issue and start governing it as identity risk.
A question worth separating out:
Q: Who is accountable when a sanctioned AI tool causes a data breach?
A: Accountability should sit with the owner of the identity and permissions behind the tool, not only the team that approved the application. If a sanctioned AI workflow can reach sensitive data, the organisation must govern its access path, logging, and containment as rigorously as any other high-risk identity.
👉 Read our full editorial: Shadow AI governance is failing faster than enterprise controls
