Shadow AI: what security teams need to govern before adoption scales

TL;DR: Shadow AI is expanding as employees use AI tools and agents without formal approval, according to Lumia Security, and 63% of organisations lacked AI governance policies to manage AI or prevent shadow AI in IBM's 2025 Cost of a Data Breach Report. The governance gap is not AI itself but the loss of visibility, control, and accountability once prompts, data, and actions move outside sanctioned workflows.

Editorial analysis by NHI Mgmt Group, based on content published by Lumia Security: “6 Shadow AI Risks that Can Disrupt Enterprise AI Usage”.

By the numbers:

• 63% of organisations lacked AI governance policies to manage AI or prevent the proliferation of shadow AI, according to IBM's 2025 Cost of a Data Breach Report cited by Lumia Security.

Key questions

Q: What is the first control teams should put in place for shadow AI?

A: Start with discovery. Security teams cannot govern what they cannot see, so the first control is a live inventory of AI tools, embedded features, and agents in use. That inventory should include who is using them, what data they touch, and which identities or tokens they rely on. Without that baseline, every later policy, review, or restriction is partly guesswork.

Q: Why do shadow AI tools create more identity risk than ordinary application sprawl?

A: Shadow AI often brings hidden identity relationships with it, such as OAuth grants, embedded secrets, and delegated API permissions.

Q: How can security teams tell whether AI lifecycle controls are working?

A: They should look for evidence that access requests, policy enforcement, and usage visibility are centrally recorded and current.

Practitioner guidance

• Build a continuous inventory of AI usage Discover standalone chatbots, coding assistants, browser extensions, embedded AI features, and autonomous agents across the business, then refresh the inventory continuously as tools and workflows change.
• Classify AI use by data sensitivity and business impact Score each use case by the type of data involved, the user role, the trustworthiness of the tool, and the possible operational impact so controls match actual risk.
• Define policy by use case, not by broad tool category Write separate rules for summarisation, coding, forecasting, customer communications, and agent actions so the policy reflects what the AI is doing rather than just which brand it belongs to.

Bottom line: Shadow AI is not a narrow chatbot problem. It is a governance gap that spans sanctioned tools, embedded features, and autonomous agents.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →