Topic starter
18/08/2026 2:29 pm
TL;DR: Unapproved AI use tripled from 15% to 45% of the workforce in a year, while 67% of employees accessing AI services on corporate devices used personal accounts outside enterprise logging and access controls, according to ArmorCode's analysis of Verizon's 2026 DBIR. The real problem is not use itself but the collapse of prevention-only models, which pushes risk into invisible channels unless governance, sanctioned alternatives, and continuous exposure management replace block lists.
Editorial analysis by NHI Mgmt Group, based on content published by ArmorCode: “Shadow AI Management: Best Practices for Enterprise Governance”.
Key questions
Q: What breaks when organisations ban shadow AI instead of governing it?
A: Bans often push AI use into personal accounts, unmanaged devices, and hidden workflows, which removes visibility from security and makes data exposure harder to detect.
Q: Why does shadow AI create a governance risk even when employees mean well?
A: Because intent does not remove exposure.
Q: What are the signs that shadow AI controls are failing in practice?
A: Shadow AI controls are failing when sensitive data moves through copy-paste, uploads, or API calls outside sanctioned workflows, yet the organisation has no alerting or enforcement at the point of transfer.
Practitioner guidance
- Define data-class rules for AI use Classify which data types may be used in approved AI tools and which must never leave sanctioned environments, then make the rule specific enough to answer the employee's decision at the moment of use.
- Provide sanctioned AI alternatives Offer enterprise-approved tools that give employees a usable path for chat, code assistance, and writing tasks so policy is backed by a practical option instead of only a restriction.
- Continuously discover shadow AI exposure Monitor SaaS, browser extensions, endpoints, and code repositories for new AI services, then reconcile discovery against the approved tool list and associated access paths.
Bottom line: Shadow AI becomes a governance failure when employees can use approved-looking tools outside the enterprise control plane and bypass logging, entitlements, and data rules.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:16 pm
Shadow AI is now an identity governance problem, not just an acceptable use problem. When employees use personal accounts or unmanaged tools, the organisation loses the ability to apply logging, access control, and accountability across the workflow. That makes the issue relevant to IAM and NHI teams, because the real control gap is visibility over who or what is acting on enterprise data. Practitioners should govern AI use as an identity-bound access surface, not as a simple software policy issue.
A few things that frame the scale:
- Organisations with high levels of shadow AI faced an average of $670,000 in additional breach costs compared with those with little or none, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
A: Start with discovery, not drafting. Baseline which AI tools people actually use, what data they submit, and where personal accounts appear. Then write short rules for sanctioned tools, prohibited data, approval paths, and violations. Pair the policy with technical enforcement such as prompt inspection, shadow AI discovery, and evidence logging so the document becomes an operating control, not aspirational text.
👉 Read our full editorial: Shadow AI governance is outpacing enterprise prevention controls