Start with discovery. Security teams cannot govern what they cannot see, so the first control is a live inventory of AI tools, embedded features, and agents in use. That inventory should include who is using them, what data they touch, and which identities or tokens they rely on. Without that baseline, every later policy, review, or restriction is partly guesswork.
Why discovery comes first for shadow AI
The first control is discovery because shadow ai is primarily a visibility problem before it becomes a policy or enforcement problem. Teams need a current inventory of tools, embedded features, browser add-ins, and autonomous agents so they can answer the basic questions: where it is used, what data it touches, and which accounts, identities, or tokens it relies on.
A live inventory should distinguish sanctioned services from unsanctioned use, because those two cases usually need different response paths. The point is not just to count applications, but to map the real operating footprint, including consented integrations, hidden API connections, and shared credentials that may be outside normal procurement or security review.
Discovery also works as the control that makes every later decision defensible. If you cannot tell whether a model is a standalone app, a SaaS feature, or an agent embedded inside another workflow, then you cannot reliably assign ownership, decide what data is allowed, or set the right restriction level.
What a useful shadow AI inventory should capture
An effective inventory has to go beyond names of products. It should record the business user or team, the use case, the data classification involved, the access path, and any supporting secrets, API keys, service accounts, or delegated OAuth grants. That is what turns a list of tools into an actionable control surface.
It is also important to track the deployment context. A model inside a collaboration suite, a note-taking assistant in a browser, and a custom agent connected to internal systems all create different exposure, even when the user experience looks similar. The inventory should preserve that distinction so reviewers can judge risk by actual capability, not marketing label.
For teams trying to operationalise this, the inventory should be updated from multiple signals, not one source of truth. Procurement records, SSO and consent logs, endpoint telemetry, browser extensions, cloud audit logs, and API traffic all reveal different parts of the shadow AI picture, and none of them is complete on its own.
Why waiting for policy alone usually fails
Policy by itself does not surface hidden adoption. Users tend to reach for whatever tool helps them finish work faster, especially when AI features are already built into the software they use every day. Without discovery, a policy often becomes a document that governs only the tools already known to security, not the tools actually in use.
That is why the first decision is a visibility decision, not a prohibition decision. Once you know what exists, you can separate low-risk experimentation from data-handling situations that need immediate review, tighter configuration, or removal of access.
The same logic applies to agentic use cases. A tool that can read mail, access files, call APIs, or act through a delegated token introduces a different control question than a simple chat interface, so discovery needs enough detail to distinguish passive use from active authority.
Risk and Threat Considerations
Shadow AI creates exposure because undiscovered tools can process sensitive information outside approved controls, reuse tokens in ways teams did not intend, or retain access long after the business owner has moved on. The security problem is not only data leakage, but also loss of accountability for who can do what on behalf of the organisation.
Failure mechanism: Untracked AI usage bypasses review, so risky data flows and delegated access persist without ownership, logging, or timely revocation.
Impact: Teams lose the ability to limit sensitive data exposure, investigate misuse, or contain a compromise quickly, and the blast radius can include credentials, customer data, and internal content.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems inventory | Discovery of shadow AI begins with an inventory of tools and agents in use. |
| Recommendation — Inventory AI tools, embedded features, and agents before applying policy or restrictions. | ||
| NIST SP 800-53 Rev 5 | CM-8 — System Component Inventory | A live inventory is the core control for identifying shadow AI assets and connections. |
| IA-5 — Authenticator Management | Shadow AI discovery must capture the tokens and secrets that enable tool access. | |
| Recommendation — Maintain a current inventory of AI tools, integrations, and supporting identities or tokens. Track and govern credentials, API keys, and tokens used by discovered AI services. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Shadow AI often depends on exposed secrets or tokens that discovery must reveal. |
| Recommendation — Detect and remove exposed secrets used by unsanctioned AI integrations. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Undiscovered agents can exercise delegated authority without proper oversight. |
| Recommendation — Map agent permissions and revoke excessive delegated access. | ||
Practitioner Guidance
What to prioritise: Start with discovery sources that reveal actual use, not just approved contracts. SSO consent records, browser and endpoint telemetry, and cloud or API logs usually give faster value than a manual questionnaire because they expose what people are already doing.
What to verify: For each discovered tool or agent, verify who owns it, whether it has access to regulated or confidential data, and whether any token or delegated permission can act without the user present. If the answer is unclear, treat that as an exception condition rather than a minor documentation gap.
Practitioner takeaway: In shadow AI, governance starts with visibility into real usage and real authority; until the inventory exists, every other control is partially blind.
Related resources from NHI Mgmt Group
- Guide: Shadow AI and AI Agent Discovery Guide
- What is the first control teams should put in place for agentic AI?
- How should security teams handle risks from AI browser extensions?
- How should security teams govern API keys used for generative AI access?
- What should teams do first when a readiness review shows too many AI control gaps?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org