Topic starter
12/02/2026 10:05 pm
TL;DR: Shadow AI is now embedded across SaaS, and the article says 99.7% of organisations use applications with AI capabilities, one in five employees use at least one AI app, and 70% of widely used applications can train on customer data, according to Wing Security. The governance problem is no longer discovery alone; it is controlling data use, model learning, and remediation before sensitive content spreads.
Editorial analysis by NHI Mgmt Group, based on content published by Wing Security: “To AI or Not to AI? SSPM Is the Answer”.
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
Key questions
Q: What breaks when hidden AI appears inside approved SaaS applications?
A: Static app categories stop reflecting real risk once vendors embed GenAI or model connectivity into software that was already approved.
Q: Why does the use of AI-enabled sub-processors create privacy and governance risk for SaaS buyers?
A: AI-enabled sub-processors can expand data exposure beyond the primary application because user content may be transmitted to additional systems for inference, automation, or support.
Q: What are the signs that Shadow AI in SaaS is not under control?
A: Common signs include widespread AI feature use without central approval, unclear training settings, users sharing sensitive content into business apps, and remediation that depends on manual review.
Practitioner guidance
- Inventory AI-enabled SaaS features Classify which sanctioned applications include embedded AI, hidden training options or user-facing AI assistants, then separate them from ordinary SaaS in governance reporting.
- Block unauthorised model training Review SaaS settings for data retention, reuse and training permissions, and disable defaults that allow sensitive content to enter model-learning paths without explicit approval.
- Automate Shadow AI remediation Create workflows that can restrict, permit or quarantine risky AI app usage as soon as discovery identifies an unapproved or impersonator application.
Bottom line: Shadow AI in SaaS turns ordinary application use into a governance problem because AI features can learn from, store or reuse sensitive business data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:31 pm
Shadow AI in SaaS is a governance problem, not just a discovery problem. Security teams can inventory AI-enabled applications and still fail to control what those applications do with sensitive data. The decisive question is whether the organisation can prevent approved tools from becoming unauthorised learning surfaces for proprietary information. Practitioners should treat AI usage policy as part of SaaS governance, not a separate side issue.
A few things that frame the scale:
- Only 37% of organisations had policies for managing AI or detecting shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
A: Security teams should treat SaaS discovery as an always-on inventory and access mapping control, not a one-time audit. The goal is to find hidden apps, browser-based AI tools, OAuth-connected services, and embedded copilots, then map who can access them and what data they can reach. Without that visibility, policy enforcement, data protection, and AI governance all start with blind spots.
👉 Read our full editorial: Shadow AI in SaaS is exposing data and training risks