Topic starter
11/06/2026 11:09 pm
TL;DR: Shadow AI now accounts for 89% of generative AI use in enterprises, with unsanctioned tools creating data leakage, compliance, and intellectual property risks as employees route sensitive work through unmanaged apps, according to JumpCloud. Blocking access alone does not solve the governance problem because discovery, policy, and approved alternatives must replace ad hoc prohibition.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “Why IT Must Discover, Govern, and Secure Shadow AI”.
By the numbers:
- 89% of generative AI use in enterprises today happens as Shadow AI, according to JumpCloud.
Key questions
Q: What breaks when employees use shadow AI for work tasks?
A: Shadow AI breaks identity visibility and lifecycle control.
Q: Why do unsanctioned AI tools create compliance risk for IAM teams?
A: They move employee data into third-party systems that may sit outside approved access, logging, and retention controls.
Q: How do you know if shadow AI governance is actually working?
A: You know it is working when you can see where AI is used, what data it touches, what actions it can take, and whether those actions are blocked or approved in real time.
Practitioner guidance
- Build shadow AI discovery into routine monitoring Trace unexpected traffic to known GenAI endpoints, review SaaS login activity, and inspect browser-based usage patterns so unsanctioned tools become visible in normal operations.
- Define acceptable AI use by data class Set explicit rules for which data types may never be placed into external AI tools, including code, customer information, and proprietary content.
- Create sanctioned alternatives for common workflows Offer approved GenAI options for content drafting, support, and knowledge work so employees have a compliant path that is easier to use than shadow tools.
Bottom line: Shadow AI is not just an acceptable-use issue. It is a governance gap that allows enterprise data and intellectual property to move into unmanaged external services.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 7:41 am
Shadow AI is an identity governance problem before it is an AI problem. The central issue is that users are making trust decisions outside approved governance channels, which means the organisation cannot reliably see, classify, or constrain where sensitive work goes. Once that happens, the control failure is not just policy noncompliance, it is the absence of a governable identity boundary around AI use. Practitioners should treat shadow AI as unmanaged access to external processing.
A few things that frame the scale:
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Should organisations block AI tools or enable them safely?
A: Organisations should enable AI safely rather than rely on blanket blocking. Bans often push employees toward personal accounts and unmonitored tools, which reduces visibility and increases risk. A safer model combines approved AI paths, data classification, monitoring, and clear enforcement for prohibited content.
👉 Read our full editorial: Shadow AI governance gaps are exposing enterprise data and IP
This post was modified 4 days ago by NHI Mgmt Group