Topic starter
24/07/2026 4:07 pm
TL;DR: Only 13% of IT and security professionals say they have full visibility into AI tools used in their organisation, leaving 87% without confidence in the inventory that GRC, privacy, and security controls depend on, according to Drata’s 2026 State of GRC survey. The practical issue is no longer AI adoption alone, but whether governance can discover and account for what employees are already using.
Editorial analysis by NHI Mgmt Group, based on content published by Drata: “The Visibility Problem: We Can't Govern the AI We Can't See”.
By the numbers:
- Only 13% of IT and security professionals are fully confident they can see every AI tool active in their organisation.
- The survey was conducted among 300 U.S. IT and security professionals.
- The survey covered companies with 1,000-20,000 employees across High-Tech, SaaS, FinTech, HealthTech, and Retail.
Key questions
Q: What breaks when shadow AI is not visible to GRC teams?
A: When shadow AI is not visible, policy, privacy review, and risk assessment stop covering the tools employees actually use.
Q: Why is visibility important in AI governance?
A: Visibility is crucial in AI governance as it enables organizations to monitor agent activity and hold them accountable for their actions.
Q: How do you know if AI discovery is actually working?
A: AI discovery is working when the organisation can produce one authoritative inventory, classify tools consistently, and explain which data and permissions each tool can reach.
Practitioner guidance
- Implement continuous AI discovery Monitor endpoints, browsers, SSO logs, and SaaS usage so new AI tools, assistants, and agents surface as soon as they appear.
- Classify AI use by data exposure Require every discovered AI tool to be tagged by the data it can access, retain, or process, including personal and confidential data.
- Assign accountable owners for AI usage Tie each approved AI capability to a business owner, a technical owner, and a review cadence so responsibility is explicit and auditable.
Bottom line: Shadow AI creates a governance blind spot when employees adopt tools faster than security and GRC teams can discover and catalogue them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:13 pm
Shadow AI is an inventory failure before it is a policy failure. Governance programs do not break because they lack rules. They break when the thing being governed arrives faster than discovery, approval, and ownership assignment. In that state, policy becomes aspirational while operational use continues outside control boundaries. Practitioners should treat AI discovery as the prerequisite control for every other governance decision.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: Should organisations treat shadow AI as a security risk or an innovation issue?
A: Treat it as both, but govern it first as a security risk. Shadow AI becomes dangerous when it can reach data, call APIs, or make decisions outside approved control paths. Security teams should build intake and review processes that allow safe experimentation without leaving identities and permissions unmanaged.
👉 Read our full editorial: Shadow AI visibility gaps are undermining governance in GRC