Topic starter
20/08/2026 5:39 pm
TL;DR: AI adoption is creating new data movement paths that let prompts, uploads, copilots, agents, and MCP workflows expose sensitive information outside traditional security visibility, according to Nightfall’s 2026 analysis. The governance gap is no longer whether data can be copied, but whether organisations can classify, intercept, and control it in real time across human and machine workflows.
Editorial analysis by NHI Mgmt Group, based on content published by Nightfall: “How to Let Employees Use AI Without Leaking Company Data”.
By the numbers:
- 39% of EMEA employees use free AI tools at work, creating shadow AI governance gaps for security teams.
- 17% of EMEA employees use AI tools they pay for privately, adding another unmanaged data movement path.
- Nightfall says 95% precision out of the box is achievable for AI-native detection compared with 5-25% legacy DLP baselines.
Key questions
Q: How should security teams govern data leakage across copilots, agents and MCP workflows?
A: Security teams should treat AI-assisted data movement as a governed workflow, not a side channel.
Q: Why does shadow AI create a governance gap for IAM and security teams?
A: Shadow AI creates a governance gap because organizations cannot manage systems they do not reliably see.
Q: What are the signs that AI usage controls are not working as intended?
A: Common warning signs include sudden token spikes, repeated 429 responses, uneven consumption across users, and budget overruns that appear before the quarter ends.
Practitioner guidance
- Deploy runtime inspection at the point of data movement Inspect prompts, uploads, browser sessions and agent requests before sensitive content reaches external AI services or connected systems.
- Discover shadow AI across managed endpoints and browsers Identify free, privately paid and otherwise unmanaged AI tools that employees are already using so policy can follow actual workflows.
- Extend NHI governance to agents and MCP workflows Treat AI agents, delegated tool calls and MCP server access as governed identities with explicit scope, auditability and revocation paths.
Bottom line: AI leakage now spans prompts, uploads, copilots, agents and MCP workflows, so the control problem is runtime governance rather than simple file blocking.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:24 pm
Shadow AI is now a governance defect, not a user-training problem. The article’s core point is that employees will adopt AI tools wherever those tools accelerate work, whether or not they are approved. That means the control gap sits in discovery, policy enforcement and runtime interception rather than in awareness alone. The practical implication is that teams must govern AI use as a sanctioned data flow, not as an exception to policy.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can organisations balance AI productivity with identity security?
A: Organisations can balance AI productivity with identity security by making secure access the easiest path, not the exception path. That means using governed access workflows, limiting credential visibility, and designing controls that work at machine speed. If the process is too manual, users bypass it; if it is too open, secrets proliferate.
👉 Read our full editorial: AI data leakage is now a governance problem, not just a DLP problem