Topic starter
23/10/2026 12:46 am
TL;DR: Unapproved AI tools appeared in 43% of security incidents, and almost seven in ten breached organisations lacked AI governance or detection processes, according to Panorays. Supplier oversight has to extend past onboarding into AI-enabled processing paths, or new data flows stay invisible.
Editorial analysis by NHI Mgmt Group, based on content published by Panorays: “Shadow AI Is Creating Vendors You Never Onboarded”.
By the numbers:
- unapproved AI tools figured in 43% of security incidents, more than double the share a year earlier
Key questions
Q: Why does shadow AI create third-party risk even when the supplier was already approved?
A: Approval at onboarding only covers the service that was reviewed at the time.
Q: What are the signs that an AI vendor is not being governed effectively?
A: Common warning signs include unclear data use terms, no visibility into what data the model consumes, weak answers on training rights or retention, and no process for ongoing review after launch.
Q: What is the failure mode when shadow AI is treated only as an employee policy issue?
A: The failure mode is that sensitive data leaves the organisation through unreviewed external services while governance teams look only at user behaviour.
Practitioner guidance
- Expand third-party reviews for AI processing paths Update supplier assessments to ask whether customer, employee, or support data can be routed into public chatbots, embedded copilots, or external model APIs.
- Inventory supplier AI features and dependencies Require vendors to disclose browser extensions, summarisation tools, model providers, and any AI functionality added after onboarding.
- Reclassify shadow AI as data transfer risk Treat unapproved AI use as an external data flow problem, with retention, access, and disclosure questions in the review record.
Bottom line: Shadow AI becomes materially different once unapproved tools or embedded features start processing enterprise data outside the approved supplier inventory.
Glossary terms: Shadow AI, Third-party AI risk, Embedded Model Dependency
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Shadow AI is a third-party risk problem before it is a user-behaviour problem. The decisive issue is not whether someone broke policy, but that enterprise data entered an external service without vendor review, retention visibility, or access accountability. That shifts the governance burden from awareness training to third-party discovery, contract terms, and ongoing reassessment. Practitioner conclusion: treat unapproved AI use as unmanaged supplier exposure.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations govern AI usage when employees use unapproved tools?
A: Organisations should start with visibility, not enforcement. If teams cannot see which apps, agents, or workflows are being used, they cannot assess data exposure or apply meaningful controls. Once usage is mapped, policy can shift from blanket bans to context-based decisions that reflect sensitivity, role, and business purpose.
👉 Read our full editorial: Shadow AI turns unreviewed vendor use into third-party risk
This post was modified 6 days ago by NHI Mgmt Group