Notifications
Clear all
Topic starter
20/08/2026 5:59 pm
TL;DR: Shadow IT and shadow AI are now a blind spot in third-party risk management because unsanctioned tools can touch sensitive data before any review process exists, according to Strac. The governance problem is not vendor assessment quality, but discovery: security teams must start from real data flows, not procurement lists, because unmanaged access is the failure mode.
NHIMG editorial — based on content published by Strac: Shadow IT and shadow AI as the third-party risk you cannot see
Questions worth separating out
Q: What is the difference between shadow IT and shadow AI?
A: Shadow IT is the use of unapproved software, while shadow AI is the use of unapproved or unmanaged generative AI services and embedded copilots.
Q: Why do shadow AI tools create more risk than sanctioned SaaS apps?
A: Shadow AI bypasses procurement, security review, and entitlement design, so it often enters with broad access and no clear accountability.
Q: How do security teams measure whether shadow-tool governance is working?
A: Look for discovery coverage, consent visibility, and remediation speed.
Practitioner guidance
- Implement continuous discovery of unsanctioned tools Monitor SaaS, browser, endpoint, and cloud usage to find tools that touch sensitive data before they appear in vendor registers.
- Triage shadow tools by data sensitivity Separate low-risk collaboration tools from tools touching PII, payment data, secrets, or internal IP.
- Govern OAuth and delegated access as identity risk Review app consents, token scopes, and third-party connectors alongside human and non-human identity controls.
What's in the full article
Strac's full article covers the operational detail this post intentionally leaves for the source:
- How its data-layer discovery identifies shadow IT and shadow AI from real usage patterns rather than vendor declarations
- How the risk scoring logic distinguishes customer PII, source code, and lower-risk collaboration data
- How to promote a discovered tool into a managed vendor with review, assessment, and document collection
- How the same detection engine supports GenAI and MCP data security workflows
👉 Read Strac's analysis of shadow IT and shadow AI as third-party risk →
Shadow AI and shadow IT: what third-party risk teams are missing?
Explore further
20/08/2026 6:38 pm
Shadow AI is now a third-party risk problem, not just an adoption problem. Unsanctioned AI tools can sit outside procurement while still handling sensitive data, which means the classical TPRM model fails at the discovery stage. Security teams that treat approval as the starting point are already behind the actual access path. The practitioner conclusion is simple: governance must begin where data moves, not where vendor paperwork begins.
A question worth separating out:
Q: Who is accountable when a sanctioned AI tool causes a data breach?
A: Accountability should sit with the owner of the identity and permissions behind the tool, not only the team that approved the application. If a sanctioned AI workflow can reach sensitive data, the organisation must govern its access path, logging, and containment as rigorously as any other high-risk identity.
👉 Read our full editorial: Shadow AI and shadow IT expose a third-party risk gap
