Notifications
Clear all
Topic starter
18/08/2026 2:29 pm
TL;DR: Unapproved AI use tripled from 15% to 45% of the workforce in a year, while 67% of employees accessing AI services on corporate devices used personal accounts outside enterprise logging and access controls, according to ArmorCode's analysis of Verizon's 2026 DBIR. The real problem is not use itself but the collapse of prevention-only models, which pushes risk into invisible channels unless governance, sanctioned alternatives, and continuous exposure management replace block lists.
NHIMG editorial — based on content published by ArmorCode: Shadow AI Management: Best Practices for Enterprise Governance
By the numbers:
- Unapproved AI use on corporate devices tripled in a year, from 15% to 45% of the workforce.
- 67% of employees accessing AI services on corporate devices used personal, non-corporate accounts.
- 75% of office professionals would consider leaving for a job with better AI skills support.
Questions worth separating out
Q: What breaks when shadow AI is not discovered early?
A: Teams lose sight of which agents exist, what they can reach, and which credentials they use.
Q: Why do macOS malware campaigns often become an identity and access problem?
A: Because many campaigns abuse session authority, user approval, or privileged execution to reach their objective.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Define an AI acceptable use policy with enforceable data classes Classify data into clear tiers such as public, internal, and restricted, then specify which AI tool categories may process each tier.
- Provide sanctioned AI alternatives that match real work patterns Offer enterprise-approved tools such as private LLM access, coding assistants, or vetted writing tools that are faster and easier than the shadow option.
- Monitor personal-account and unmanaged-device AI access Look for AI usage that shifts to personal devices, browser-based tools, and non-corporate accounts, because those are the paths that exit enterprise logging and identity controls.
What's in the full article
ArmorCode's full blog covers the operational detail this post intentionally leaves for the source:
- The article's policy language for classifying public, internal, and restricted data across AI tools
- The governance model for sanctioned alternatives, including private LLMs, coding assistants, and vetted writing tools
- The continuous exposure management approach for discovering new AI tools and browser plugins
- The automation pattern for routing findings into remediation workflows without handing over governance decisions
👉 Read ArmorCode's analysis of shadow AI governance and enterprise controls →
Shadow AI governance is outpacing enterprise prevention controls?
Explore further
18/08/2026 3:16 pm
Shadow AI is becoming an identity-governance problem before it is a tooling problem. When employees move work into personal accounts and unmanaged devices, the enterprise loses the ability to tie AI activity back to sanctioned identities. That weakens auditability, policy enforcement, and incident reconstruction in the same move. For IAM and governance teams, the real issue is not whether AI is allowed, but whether its use remains attributable and enforceable.
A question worth separating out:
Q: Who is accountable when an employee uses an AI tool to trigger harmful access?
A: Accountability stays with the organisation's identity governance and control owners, because the risky behaviour arises from delegated access paths that the business permitted. The right question is whether the delegation chain, review process, and containment controls were defined for AI-assisted execution. The NHI Lifecycle Management Guide is a useful reference for that governance.
👉 Read our full editorial: Shadow AI governance is outpacing enterprise prevention controls
