Topic starter
23/10/2026 12:45 am
TL;DR: Shadow AI becomes risky when organisations can see the tool but not the reason data is being sent into it, according to DTEX. Governance needs behavioural context because intent, account type and data sensitivity change whether an AI event is harmless or harmful.
Editorial analysis by NHI Mgmt Group, based on content published by DTEX: “Shadow AI Isn’t a Discovery Problem. It’s an Intent Problem.”.
Key questions
Q: Why does the same GenAI activity sometimes represent different risk levels?
A: Risk changes because context changes.
Q: How do security teams know if shadow AI is actually under control?
A: Security teams know shadow AI is under control when they can inventory every agent, model workflow, and tool connection, then map each one to an owner and access scope.
Q: What breaks when shadow AI is not discovered early?
A: Teams lose sight of which agents exist, what they can reach, and which credentials they use.
Practitioner guidance
- Implement prompt-level AI telemetry Capture the destination model or application, the account used, and the content class of what was entered so security teams can assess actual exposure rather than guess from application inventory alone.
- Correlate AI use with behavioural signals Compare AI activity with role, normal working patterns, source repository access, policy history, and unusual volume to distinguish productivity, negligence, and deliberate bypass.
- Classify data before it enters external models Tag source code, credentials, customer records, strategy material, and regulated data so controls can block or warn before sensitive content leaves approved environments.
Bottom line: Shadow AI becomes risky when organisations can see the tool but not the reason data is being sent into it.
Glossary terms: Shadow AI, Prompt-Level Telemetry, Risk-Adaptive Response, Behavioral Correlation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Shadow AI is now a governance problem, not an inventory problem. Discovery answers where AI is being used, but it cannot tell you whether the activity is business-justified, careless, or malicious. The field needs a control model that evaluates intent, data sensitivity, and behavioural context together. That is the difference between knowing an application exists and knowing whether it is safe to trust.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- One in five organisations reported a breach due to shadow AI, and 97% of those breached through an AI model or application lacked proper AI access controls, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: Should organisations block AI tools or enable them safely?
A: Organisations should enable AI safely rather than rely on blanket blocking. Bans often push employees toward personal accounts and unmonitored tools, which reduces visibility and increases risk. A safer model combines approved AI paths, data classification, monitoring, and clear enforcement for prohibited content.
👉 Read our full editorial: Shadow AI governance fails when intent is invisible to discovery
This post was modified 6 days ago by NHI Mgmt Group