Topic starter
12/06/2026 12:40 am
TL;DR: Employees are already pasting code, customer data, and internal documents into public LLMs, creating Shadow AI leakage paths that bypass IT governance, logging, and policy enforcement, according to Pomerium. The real issue is not whether users will adopt AI, but whether identity, access, and data controls can bound that adoption before sensitive context escapes.
Editorial analysis by NHI Mgmt Group, based on content published by Pomerium: “Your Employees Are Already Dumping Company Data to LLMs (Here’s What To Do About It)”.
Key questions
A: Security teams should treat public LLM use as a governed data handling problem, not just a technology choice.
Q: Why do shadow AI tools create risk for IAM teams?
A: Shadow AI complicates IAM because the real subject is often not just the employee, but the AI service, token, or connector acting on the employee's behalf.
Q: What breaks when employees use LLMs through personal accounts and devices?
A: The enterprise loses the audit trail and the enforcement point.
Practitioner guidance
- Enforce an identity-aware AI gateway Require all approved LLM traffic to pass through a gateway that validates user identity, applies policy and records each context load before any data reaches an external model.
- Bind model access to enterprise authorisation Map each AI request to the same permissions that govern the originating user or service account, so the model only receives data already within that subject’s approved scope.
- Log every prompt and retrieval event Capture who requested the context, what data was retrieved, which model received it and whether the request came from a user, tool or agent.
Bottom line: Shadow AI is an access-governance failure as much as a data-protection issue, because unmanaged LLM use bypasses authentication, authorisation and auditability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 10:05 am
Shadow AI is now an identity governance problem, not just a data loss problem. The article’s central point is that employees are already creating unsanctioned AI access paths that sit outside standard IAM, logging and policy controls. Once context leaves through those channels, traditional governance has no clean way to recover visibility or enforce scope. Practitioners should treat AI usage as a governed access domain, not an exception to policy.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations prioritise logging or content filtering first for AI governance?
A: Start with logging and identity binding, then add filtering. If you cannot prove who accessed what, the organisation cannot investigate misuse or demonstrate control. Content filtering is important, but without identity-aware logging it only reduces risk at the margins and still leaves the path ungoverned.
👉 Read our full editorial: Shadow AI is exposing company data to LLMs through ungoverned access
This post was modified 1 day ago by NHI Mgmt Group