Notifications
Clear all
Topic starter
10/06/2026 11:55 pm
TL;DR: Shadow AI is now embedded in daily work across engineering, analytics, product, and sales, and vendors and analysts cited in the article show that most organisations are already using AI in cloud systems while many employees share sensitive information without permission. The governance gap is not adoption itself, but the lack of visibility, approved alternatives, and identity controls around where AI tools touch data and permissions.
NHIMG editorial — based on content published by Orca Security: Shadow AI risks, governance, and mitigation in cloud environments
By the numbers:
- 78% of organizations now use AI in cloud systems, with 72% using it in daily operations.
- (38%) of employees admit to sharing sensitive work, sensitive work information with AI tools without their employer's permission.
- 80% of AI tools operating within companies are unmanaged by IT or security teams.
Questions worth separating out
Q: How should security teams govern Shadow AI in cloud environments?
A: Start by tying AI usage to the identities, SaaS accounts, and APIs that actually move the data.
Q: Why does Shadow AI matter to IAM and NHI programmes?
A: Because AI tools frequently inherit access from existing human and workload identities, which means the identity layer can look compliant while the data path is not.
Q: What breaks when employees use AI tools without approval?
A: Visibility breaks first, followed by data handling control and output trust.
Practitioner guidance
- Map AI usage to identity and data paths Inventory where employees, SaaS platforms, browser extensions, and APIs are sending prompts or content, then tie each path back to the identity that initiated it.
- Publish approved AI use rules by data class Define which data types may be entered into external AI tools, which tools are approved, and which outputs require review before reuse.
- Review SaaS and browser integrations for hidden AI features Many Shadow AI cases come from features embedded in tools already approved by IT.
What's in the full article
Orca Security's full article covers the operational detail this post intentionally leaves for the source:
- Specific examples of Shadow AI across engineering, data analytics, product, marketing, and sales workflows
- Detailed guidance on establishing AI governance policy, including approved tools, data handling rules, and accountability
- Visibility methods for detecting embedded AI usage across cloud assets, SaaS integrations, APIs, and identities
- Operational steps for providing secure, approved alternatives without blocking employee productivity
👉 Read Orca Security's analysis of Shadow AI risks and cloud governance →
Shadow AI in cloud environments: what IAM teams need to see?
Explore further
12/06/2026 6:20 am
Shadow AI is an identity governance problem before it is an AI adoption problem. The article shows that unmanaged AI use is spreading through ordinary work patterns, which means access is being extended outside approved review, logging, and policy paths. That is a control boundary failure, not just a user-behaviour issue. The practitioner conclusion is that AI governance must be joined to identity governance from the start.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to the same report.
A question worth separating out:
Q: How do you know if Shadow AI controls are working?
A: Look for a shrinking set of approved AI services, visible logs for prompt and integration activity, clear data-class restrictions, and documented review steps for outputs. If employees still rely on unofficial tools for core work, the programme is not yet governing behaviour, only issuing guidance.
👉 Read our full editorial: Shadow AI is exposing cloud identities faster than governance can track
