Notifications
Clear all
Topic starter
01/08/2026 10:51 pm
TL;DR: Shadow AI is now a visibility and governance problem, not just an employee misuse problem, because unsanctioned AI tools can inherit user access, process regulated data, and act across multiple systems without security oversight, according to Akto. The real control gap is that traditional IT and IAM models were built for known applications and static permissions, not hidden AI workflows that can move data and decisions in real time.
NHIMG editorial — based on content published by Akto: Shadow AI Security Risks: Technical Threats, Detection and Mitigation in the Enterprise
By the numbers:
- Researchers analyzing tens of millions of enterprise AI prompts have tracked more than 665 distinct generative AI applications in active use across corporate environments.
- According to IBM's 2025 Cost of a Data Breach Report, organizations with high levels of shadow AI faced an average of $670,000 in additional breach costs compared to organizations with low or no shadow AI.
- Ponemon Institute's 2026 insider risk research found that negligent or mistaken insider incidents now cost organizations an average of $10.3 million annually.
Questions worth separating out
Q: What breaks when shadow AI is not discovered early?
A: Teams lose sight of which agents exist, what they can reach, and which credentials they use.
Q: Why do shadow AI tools complicate IAM governance?
A: Shadow AI tools complicate IAM because they can hold real privileges without appearing in normal inventory or review processes.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Inventory AI tools, extensions, and agents Build a living inventory of sanctioned and unsanctioned AI tools, browser extensions, plugins, and connected agents.
- Apply least-privilege to AI integrations Treat every AI connector as a privileged integration and restrict it to the minimum data and action scope needed.
- Log every agent action and data access event Capture prompts, tool calls, file reads, delegated actions, and downstream API activity so investigations can reconstruct what the AI system actually did.
What's in the full article
Akto's full blog covers the operational detail this post intentionally leaves for the source:
- The article's detection approach for shadow AI discovery across endpoints, browsers, SaaS, and identity signals
- Specific examples of prompt injection and agentic manipulation in unsanctioned AI workflows
- Implementation guidance for runtime guardrails, logging, and continuous red teaming of discovered AI agents
- The article's view of governance workflows for compliance, privacy, and legal teams
👉 Read Akto's analysis of shadow AI security risks and enterprise mitigation →
Shadow AI security risks: are your identity controls keeping up?
Explore further
01/08/2026 10:59 pm
Shadow AI is becoming an identity governance problem before it becomes a tooling problem. Once AI systems inherit user credentials and can act across multiple services, the security boundary shifts from application inventory to delegated authority. That is why the governance question is not whether an AI tool is approved in procurement, but whether its identity, access scope, and downstream integrations are controlled. For IAM and NHI teams, the control model now has to follow the runtime path of the AI system, not just the user who opened it.
A question worth separating out:
Q: Who is accountable when a sanctioned AI tool causes a data breach?
A: Accountability should sit with the owner of the identity and permissions behind the tool, not only the team that approved the application. If a sanctioned AI workflow can reach sensitive data, the organisation must govern its access path, logging, and containment as rigorously as any other high-risk identity.
👉 Read our full editorial: Shadow AI security risks expose a governance gap IAM cannot ignore
