Topic starter
10/06/2026 11:45 pm
TL;DR: Shadow AI is now a workforce-scale identity problem, with 81% of the global workforce using an unapproved AI tool for work tasks, according to JumpCloud. The security issue is not just unsanctioned usage but data being ingested into model training, which makes traditional block-and-delete controls insufficient.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “How to Govern Shadow AI Before It Becomes a Security Breach”.
By the numbers:
- 81% of the global workforce has used an unapproved AI tool to complete a work task, according to JumpCloud.
Key questions
Q: How should teams govern shadow AI in existing IAM programmes?
A: They should treat shadow AI as an identity and access issue, not a standalone AI issue.
Q: Why is shadow AI harder to manage than ordinary shadow IT?
A: Shadow AI is harder because the tools can process sensitive content as part of normal use, which creates both data exposure and compliance risk.
Q: What are the warning signs that shadow AI is becoming a security problem?
A: Look for AI tools connected outside approved procurement, unexplained API or token usage, and data leaving normal SaaS boundaries.
Practitioner guidance
- Inventory AI tools across the browser layer Audit browser extensions, desktop add-ons, and approved web apps that can read or write corporate content.
- Review OAuth grants and delegated access paths Check which third-party apps and AI helpers have been granted access to Google Workspace or Microsoft 365 and remove permissions that exceed the actual task scope.
- Apply least privilege to AI access Limit each AI assistant or agent to the smallest data set and shortest session required for the business use case, rather than allowing broad workspace or tenant-wide access.
Bottom line: Shadow AI is not just another shadow IT variant, because data shared with AI tools can become part of model training or later reuse.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 6:05 am
Shadow AI is an identity governance problem before it is a tooling problem. The article correctly reframes unsanctioned AI use as an NHI issue because the control question is who or what receives access, on what scope, and for how long. Once employees can hand corporate data to external models or extensions, the risk is no longer limited to application choice; it becomes an access and lifecycle issue that identity teams must govern.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations block AI tools or enable them safely?
A: Organisations should enable AI safely rather than rely on blanket blocking. Bans often push employees toward personal accounts and unmonitored tools, which reduces visibility and increases risk. A safer model combines approved AI paths, data classification, monitoring, and clear enforcement for prohibited content.
👉 Read our full editorial: Shadow AI is exposing NHI governance gaps in enterprise IAM
This post was modified 4 days ago by NHI Mgmt Group