Topic starter
11/11/2026 5:59 pm
TL;DR: Shadow AI creates blind spots when employees connect unsanctioned AI services to corporate accounts, according to WatchGuard. Security teams need visibility into authorizations, permissions and encrypted traffic, because approved access can still become an exposure path.
Editorial analysis by NHI Mgmt Group, based on content published by WatchGuard: “Not Making It Easy for Attackers Also Starts with Catching What Slips Through”.
By the numbers:
- The WatchGuard Global Threat Report H1 2026 says 95% of the malware observed on the network arrived via encrypted TLS connections.
- The WatchGuard Global Threat Report H1 2026 says only 20% of Fireboxes were inspecting that traffic.
Key questions
Q: Why does shadow AI create more risk when organisations try to prohibit it?
A: Prohibition often shifts usage underground, which reduces visibility and weakens logging, data control, and accountability.
Q: How should security teams inspect encrypted traffic from cloud services?
A: Security teams should inspect encrypted traffic selectively by terminating or mirroring TLS at controlled inspection points, then re-encrypting traffic before it reaches the destination.
Q: How do teams govern access granted to AI integrations?
A: Teams govern access to AI integrations by treating each integration as a delegated identity with a defined owner, scope, approval path and revocation method.
Practitioner guidance
- Audit all AI-related authorizations Build an inventory of chatbot, extension and integration authorizations granted from corporate accounts, then flag anything that can reach email, files or calendars.
- Tighten consent review for delegated access Require approval for any service that requests permissions beyond a single-user task, especially where inbox, file or calendar scopes are involved.
- Expand security awareness to AI use cases Train employees to check whether the data shared with an AI service matches the job to be done and whether the service can act on their behalf.
Bottom line: Shadow AI becomes a governance issue when external services inherit corporate trust through user authorizations and can act on mail, files or calendars.
Glossary terms: Shadow AI, Delegated Access, TLS Inspection, OAuth Consent
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Shadow AI is an identity problem before it is an AI problem. The core governance failure is that employees can create trusted connections to external services without those services passing through the same lifecycle controls as other accounts. That means access can exist outside inventory, outside review and outside revocation discipline. Practitioners should treat every AI integration as a governed access path, not as a harmless productivity add-on.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should employees do before granting an AI tool access to work data?
A: Employees should confirm the tool is approved, check the requested data scope, and verify whether the access is read-only, limited to the inbox, file or calendar access needed for the task. They should also review the consent screen for the signing account, because broad OAuth permissions can expose mail, files and scheduling data beyond the intended use.
👉 Read our full editorial: Shadow AI hides risky access and malware in encrypted traffic