Topic starter
11/11/2026 6:02 pm
TL;DR: With 64% of employees admitting to using unauthorized AI tools and fewer than 30% believing their organisation has an accurate software inventory, WatchGuard says shadow AI is common. SaaS governance now depends on continuous visibility into applications, integrations and the identities that connect them.
Editorial analysis by NHI Mgmt Group, based on content published by WatchGuard: “Shadow AI Is Only the Symptom: The Real Problem Is SaaS Visibility”.
By the numbers:
- 64% of employees admit to using unauthorized AI tools for work.
- Fewer than 30% of respondents believe their organisation maintains an accurate software inventory.
- 39% say their organisation does not maintain an accurate software inventory.
Key questions
Q: Why do SaaS inventories miss shadow AI usage?
A: SaaS inventories miss shadow AI usage because users sign up for external AI tools outside approved procurement, often with personal email accounts or browser sessions that never touch corporate CASB, SSO, or SaaS discovery controls.
Q: What is the difference between OAuth and direct login?
A: OAuth delegates authorisation to a trusted application so it can obtain scoped access tokens without learning the user’s password.
Q: Why do shadow AI tools create more risk than sanctioned SaaS apps?
A: Shadow AI bypasses procurement, security review, and entitlement design, so it often enters with broad access and no clear accountability.
Practitioner guidance
- Implement continuous SaaS discovery Track applications, integrations, permissions and identity activity as a living control, not a quarterly audit output.
- Review delegated OAuth grants Classify SaaS integrations by scope, business owner and last-use date, then remove broad or orphaned authorisations.
- Unify AI and SaaS governance Bring unauthorized AI services into the same approval, inventory and access review process used for other business applications.
Bottom line: Shadow AI is exposing a wider SaaS governance gap, where inventory accuracy and delegated access matter more than isolated tool approval.
Glossary terms: Shadow AI, OAuth Grant, Delegated Access, SaaS Visibility
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:08 pm
Shadow AI is a symptom of SaaS governance collapse, not the root cause. The real control failure is that organisations cannot reliably see their application estate, its integrations or the identities attached to it. When visibility is incomplete, policy enforcement becomes selective and review becomes retrospective. The practical conclusion is that shadow AI should be treated as an inventory and access governance failure first, and an AI policy problem second.
A few things that frame the scale:
- 8 of the top 10 fastest-growing types of leaked secrets year-over-year are tied directly to AI services, according to the State of Secrets Sprawl 2026.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do first when shadow AI appears in the environment?
A: Organisations should treat the tool as an unmanaged identity, then decide whether it is allowed to handle business data at all. The first 24 to 72 hours should focus on discovery, containment, and policy enforcement at the access boundary. If the tool cannot be governed inline, it should be denied by default.
👉 Read our full editorial: Shadow AI exposes a broader SaaS visibility gap in the workplace