Topic starter
24/10/2026 8:54 pm
TL;DR: Work-device AI use is already broad enough that blanket bans are unlikely to remove it, according to Hoxhunt. Governance has to make approved paths easier than workarounds if organisations want to limit unsanctioned tools and data flows.
Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “You Can't Ban Your Way Out of Shadow AI”.
By the numbers:
- 45% of employees use AI regularly on work devices, approved or not, up from 15% a year earlier.
- 63% of UK workers had already used generative AI for work, and nearly a third of those users were doing so without their employer's knowledge.
- 67% of employees accessing AI services were using non-corporate accounts on their work devices.
Key questions
A: Shadow AI raises risk because external AI services can process sensitive inputs outside approved data protection, audit, and compliance controls.
Q: What are the signs that shadow AI controls are failing in practice?
A: Shadow AI controls are failing when sensitive data moves through copy-paste, uploads, or API calls outside sanctioned workflows, yet the organisation has no alerting or enforcement at the point of transfer.
Q: How should security teams govern shadow AI without blocking productivity?
A: Use visibility-based controls instead of blanket bans.
Practitioner guidance
- Map employee AI usage by account type Identify where staff are using personal, corporate and embedded AI services on work devices, then classify which routes are sanctioned, tolerated or prohibited.
- Review delegated permissions on connected AI tools Audit OAuth grants, email access, storage connectors and CRM integrations that let AI tools act inside other systems, then remove unused or excessive access.
- Shorten the path to approved AI use Make the sanctioned route faster than the workaround by reducing approval friction, publishing approved tool lists and giving clear guidance on data handling.
Bottom line: Shadow AI persists when employees can reach AI through easier routes than the ones security teams approve.
Glossary terms: Shadow AI, Delegated Access, OAuth Grant, Acceptable Use Policy
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:13 am
Shadow AI is fundamentally a delegation governance problem. The article makes clear that the risk is not just content leakage but the authority employees hand to AI tools through connected accounts, APIs and workspace permissions. That places Shadow AI squarely in the identity governance domain because the control boundary is no longer only the user, but the user plus everything they let the tool do. Teams should govern AI as delegated access, not as a novelty app category.
A few things that frame the scale:
- One in five organisations reported a breach due to shadow AI, and 97% of those breached through an AI model or application lacked proper AI access controls, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: Should organisations prioritise monitoring or user enablement first for Shadow AI?
A: Do both, but start with the specific work people are trying to complete. Monitoring tells you where the risk sits. Enablement tells you why it exists. If you only watch, users route around you. If you only enable, you may miss the high-risk services and data flows that need hard limits.
👉 Read our full editorial: Shadow AI is a governance problem, not a ban problem
This post was modified 6 days ago by NHI Mgmt Group