Topic starter
11/11/2026 6:01 pm
TL;DR: Shadow AI enters through consent grants, personal accounts and network-only use, according to WatchGuard, which makes discovery depend on correlating identity, endpoint and firewall telemetry. Security teams need governance across all three paths or unapproved AI use stays invisible until data exposure or compliance findings surface.
Editorial analysis by NHI Mgmt Group, based on content published by WatchGuard: “How to Find Shadow AI: 3 Hidden Entry Points”.
By the numbers:
- 64% of employees report using unsanctioned AI tools for work tasks.
- Shadow AI incidents cost organisations an average of $5.39 million, above the global average breach cost of $4.99 million.
Key questions
Q: Why do OAuth consents create shadow AI risk even when the app is approved?
A: OAuth consents can turn a short user interaction into durable cloud access with read, write or delete scope.
Q: How does network telemetry help find unsanctioned AI use?
A: Network telemetry helps find unsanctioned AI use by showing connections to known AI services, unusual DNS lookups, web traffic to browser-based chat tools, and data uploads to unfamiliar endpoints.
Q: What are the signs that shadow AI is already operating in an organisation?
A: Common signs include sudden productivity jumps in a team, unusual data uploads to external AI platforms, and unexplained API calls or suspicious queries to third-party services.
Practitioner guidance
- Establish a shadow AI discovery baseline Correlate OAuth grants, SaaS app lists, browser activity and network destinations to identify AI services that already exist in the environment.
- Review and revoke high-risk consent grants Prioritise applications with access to email, files, calendars or contacts, then remove permissions that no longer match a documented business need.
- Separate personal-account AI use from approved workflows Define where business data may be processed, then enforce those boundaries with policy, user guidance and monitoring that covers non-corporate sign-ins.
Bottom line: Shadow AI is not just a procurement or policy issue. It is an access governance problem created by fast adoption, delegated permissions and unmanaged data paths.
Glossary terms: Shadow AI, OAuth Consent, Consent Phishing, SaaS
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Shadow AI is now an access governance problem, not just an application inventory problem. The article shows that employees can bring AI services into the environment through multiple on-ramps, and each one leaves different evidence. That changes the discipline from counting tools to governing how data, identity and consent intersect. Practitioners should treat discovery as the entry point to control, not the end state.
A few things that frame the scale:
- One in five organisations reported a breach due to shadow AI, and 97% of those breached through an AI model or application lacked proper AI access controls, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: Where does SaaS governance stop covering shadow AI?
A: SaaS governance stops at the corporate identity boundary, where control over sanctioned tenant access, app approvals, and account provisioning ends. Shadow AI begins when employees use external AI tools through personal accounts, unmanaged devices, or unsanctioned browser sessions outside SSO, CASB, and access policy enforcement.
👉 Read our full editorial: Shadow AI reaches company data through OAuth and personal accounts