Notifications
Clear all
Topic starter
10/06/2026 11:56 pm
TL;DR: Shadow AI is now a daily reality, with 8 in 10 office workers using some form of public AI, 60% of organisations already seeing a data exposure event, and AI-related incidents taking 26.2% longer to identify, according to JumpCloud. The governance problem is not adoption itself but the lack of visibility, policy, and sanctioned alternatives across identity-controlled access paths.
NHIMG editorial — based on content published by JumpCloud: The 2026 State of Shadow AI
By the numbers:
- 8 in 10 office workers now use some form of public AI, often without their IT department’s knowledge or approval.
- By 2026, 70% of employee interactions with AI will occur through features embedded in existing, sanctioned SaaS applications.
- Enterprise traffic to AI applications increased by a staggering 595% between April 2023 and January 2024.
Questions worth separating out
Q: How should security teams govern shadow AI without blocking all employee use?
A: Start by discovering where AI already appears in sanctioned SaaS, browsers, and public tools, then apply policy to the specific data flows and identities involved.
Q: Why do unsanctioned AI tools create compliance risk for IAM teams?
A: They move employee data into third-party systems that may sit outside approved access, logging, and retention controls.
Q: What do organisations get wrong about acceptable use policies for AI?
A: They often treat acceptable use as a document instead of a control.
Practitioner guidance
- Inventory AI entry points across sanctioned SaaS Map where employees are already encountering AI inside approved applications, then separate those flows from standalone public tools so you can apply different controls to each path.
- Bind AI usage policy to enforceable identity controls Translate acceptable use rules into identity provider conditions, device posture checks, and approved application restrictions so the policy can actually shape behaviour.
- Classify prompt and output data flows Treat prompts, uploaded files, and model outputs as governed data movements, then define what can be sent, where it can go, and who owns the resulting telemetry.
What's in the full article
JumpCloud's full research covers the operational detail this post intentionally leaves for the source:
- The survey methodology behind the shadow AI statistics and how respondents were segmented
- The full breakdown of where shadow AI appears across employee workflows and application types
- The report's guidance on discovery, governance, and enablement as a three-part response model
- The business impact discussion on tool sprawl, redundancy, and unsanctioned code assistants
👉 Read JumpCloud's 2026 shadow AI report for the full survey findings →
Shadow AI and identity governance: what are teams missing?
Explore further
12/06/2026 6:21 am
Shadow AI is an identity governance problem before it is a technology problem. The article shows employees adopting AI outside sanctioned workflows, which means the organisation cannot reliably assert who is using what, through which account, or with which data. That is a governance failure because the control model depends on discovery and policy coverage, not just on user intent. The practical conclusion is that shadow AI should be managed as part of identity, SaaS, and data governance together.
A few things that frame the scale:
- 59.8% of organisations see value in a solution that simplifies non-human access management and introduces dynamic ephemeral credentials, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
A question worth separating out:
Q: How do security teams know if shadow AI governance is working?
A: Look for reduced use of unsanctioned tools, better visibility into AI data flows, and more employee traffic moving through approved applications. If incidents are still difficult to trace or employees keep finding external tools for common work, governance has not yet reached the operational layer.
👉 Read our full editorial: Shadow AI is exposing governance gaps in enterprise identity
