Shadow Agents:
How to Detect &
Govern Unapproved AI
Visibility and Strategic Oversight in Your Network. 98% of organisations report unsanctioned AI use. 86% lack visibility into how data flows to and from AI tools. The board is now accountable. This is the complete governance framework for detecting, classifying, and controlling shadow AI before it controls you.
The Problem Is No Longer Coming. It Is Already Inside Your Network.
Shadow AI is not the AI governance problem of 2027. It is operating inside your organisation today, at scale, without your knowledge. The employees entering customer data into ChatGPT to draft support emails, the finance analyst uploading contract terms to Claude for clause extraction, the engineer pasting source code into Copilot for debugging — none of them are acting maliciously. They are filling a governance vacuum that leadership has not yet closed.
Shadow AI is categorically different from its predecessor, shadow IT. When employees used unapproved file storage, data sat in a bucket somewhere. When employees use unapproved AI, data flows into models that can learn from it, store it, surface it in responses to other users, and be exploited by adversaries who have access to those models. The data does not just sit somewhere — it becomes part of something larger and far less controllable. The average enterprise now uploads 8.2 GB of data per month to AI applications, according to Netskope’s 2025 Cloud and Threat Report. Most of it flows through tools the CISO has never reviewed.
And crucially: leadership is modelling the behaviour it needs to stop. Microsoft’s 2026 Data Security Index found that 69% of presidents and C-suite executives openly prioritise speed over data privacy when adopting new AI tools. The exposure created by a CEO pasting a board presentation into a public LLM for summarisation is identical to the exposure created by an intern doing the same thing — and far more consequential if it contains material non-public information.
The 2025 incidents that define the stakes: Amazon employees found pasting confidential internal data into ChatGPT, with model outputs later resembling proprietary internal documents. Slack’s AI summarisation feature leaked data from private channels across user boundaries. A CVSS 9.3-rated zero-click prompt injection vulnerability disclosed in Microsoft Copilot — a tool deployed inside thousands of enterprise environments. Shadow AI is not theoretical. It is the source of documented, material incidents at organisations that believed their AI governance was adequate.
Understanding the Four Types of Shadow AI
Shadow AI is not a single category — it is four distinct threat classes that require different detection approaches and different governance responses. Misidentifying the class means deploying the wrong control.
The 5 Pillars of Shadow AI Detection
No single detection layer provides complete shadow AI visibility. The four shadow AI types each require different detection approaches — which is why five complementary pillars are required for comprehensive coverage.
Network-level detection is the most foundational shadow AI visibility layer — and the one most enterprises already have partial infrastructure for. Firewall logs, web proxy traffic, and DNS query data contain the raw signal that reveals which AI platforms are being accessed from enterprise networks. Analysis of traffic to domains like openai.com, api.anthropic.com, generativelanguage.googleapis.com, and the rapidly expanding catalogue of GenAI SaaS platforms (over 1,550 distinct applications as of 2025) provides the baseline inventory of AI tool usage across the organisation.
The limitation is traffic visibility — network-level detection catches traffic from managed devices on corporate networks but is blind to personal devices, mobile networks, and home Wi-Fi use. It also cannot inspect the content of HTTPS traffic without SSL inspection, limiting it to detection rather than data classification. Used as the foundational layer, network signals provide the breadth map; other pillars provide the depth.
Cloud Access Security Brokers (CASBs) and Security Service Edge (SSE) platforms sit between enterprise users and cloud applications, providing the application-level visibility that network monitoring alone cannot deliver. Where proxy logs show traffic to openai.com, a CASB can identify which specific feature was used, what data classification was uploaded, whether the account is personal or enterprise-managed, and whether the session involved sensitive data patterns.
CASBs are particularly effective for the Embedded SaaS AI category — detecting when approved SaaS platforms enable unapproved AI features that inherit the platform’s trusted status. The 2024 Slack AI cross-channel data leak would have been visible in a CASB that tracked AI feature usage within the Slack application, even though Slack itself was an approved platform. In 2026, leading CASBs include AI-specific risk ratings for over 1,000 GenAI applications — making rapid policy decisions against a pre-assessed risk catalogue rather than manual analysis of each new tool.
Endpoint Detection and Response (EDR) telemetry provides the visibility layer for shadow AI activity that occurs at the device level — particularly browser extensions with AI capabilities that are invisible to network monitoring because their traffic appears as normal HTTPS from an approved browser. Endpoint telemetry can identify installed browser extensions, track which extensions interact with page content or clipboard data, and flag extensions that communicate with AI model APIs.
This pillar is also the detection surface for locally-running AI models — small language models like Mistral or LLaMA running directly on developer workstations without any network traffic at all. As local AI inference becomes more accessible, this category of shadow AI will grow. Endpoint telemetry combined with application inventory management provides the foundation for detecting all four shadow AI types at the device layer, filling the gaps that network-level and cloud-level monitoring cannot reach.
IAM and OAuth monitoring is the detection surface for the most dangerous shadow AI category: API-driven custom workflows and agentic systems built by employees without security review. When an employee builds a LangChain agent connecting to the company’s CRM, they typically authenticate that agent using their own OAuth credentials — granting it the same permissions they personally hold. If they are a CRM administrator, the agent has administrator access. This permission inheritance creates an unmonitored privileged agent that security teams cannot see through traditional identity management tools.
Only 10% of organisations have a strategy for managing non-human identities (NHIs) — Okta AI at Work 2025. The UNC6395 attack of August 2025, in which stolen OAuth tokens from a trusted SaaS integration provided access to 700+ organisations’ Salesforce environments, demonstrated exactly what unmonitored OAuth delegation enables at scale. AI agent workflows depend on OAuth grants, API tokens, and service account credentials that must be inventoried and governed with the same rigour as human identities.
Data Loss Prevention (DLP) and data classification provide the content-aware context layer that answers the most critical governance question: not just which AI tools are being used, but what data is entering them. Cisco’s 2025 findings indicate that 46% of organisations have already experienced internal data leaks through GenAI — but without DLP integration, those organisations would have had no mechanism to detect the leak at the moment it occurred. Data classification systems that label documents as Confidential, PII, Regulated, or Customer Data enable DLP systems to intercept AI-bound uploads before they leave the enterprise.
The compliance dimension makes this pillar particularly urgent. HIPAA violations carry fines up to $1.5 million per violation category regardless of intent. GDPR carries fines up to €20 million or 4% of global turnover. EU AI Act penalties reach €35 million for prohibited practice violations. An employee sending protected health information to an unapproved LLM creates a direct HIPAA violation — whether or not their manager approved the workflow. DLP with AI-specific awareness is the technical control that closes the intent-blind compliance exposure.
“Blocking shadow AI is counterproductive. If you block things, you are just blocking visibility. The landscape of AI is evolving so fast that people will use AI on a day-to-day basis — and blocking it is just encouraging them not to be visible around using it. The goal is governed adoption, not enforced prohibition.”
Amar Akshat, SVP Technology & Chief Architect, Paysafe — Okta C-Suite AI Survey, February 2026The Practical 30-Day Implementation Playbook
Shadow AI governance is not a multi-year transformation programme. The first 30 days can establish the visibility, decision frameworks, and executive baseline that make the rest of the programme executable. Research confirms that providing enterprise-grade AI alternatives reduces unauthorised use by 89% — making the 30-day window the highest-leverage governance investment available.
Executive Oversight: 5 Board-Level AI Risk Metrics
These five metrics constitute the minimum viable AI risk reporting framework for board-level oversight. Each metric answers a governance question the board is now accountable for — and provides the evidence base for demonstrating responsible AI governance to regulators, insurers, and auditors.
The Governance Vacuum Is the Board’s Risk to Own
Shadow AI is not a technology problem that CISOs can solve in isolation from executive leadership. It is a behaviour problem that persists because governance frameworks have not kept pace with the accessibility of AI tools — and because, in many organisations, leadership is modelling the very behaviour that creates the exposure. Microsoft’s 2026 Data Security Index found that 69% of C-suite executives prioritise speed over data privacy when adopting AI. That preference, expressed from the top of the organisation, signals to every employee that compliance is optional when productivity is at stake.
The regulatory environment of 2026 will not accept this posture. The EU AI Act’s high-risk system obligations are fully enforceable from August 2026. Gartner predicts that by 2030, more than 40% of enterprises will experience security or compliance incidents due to unauthorised AI use. Insurance underwriters are already requiring evidence of AI governance maturity for D&O coverage. The board is accountable not only for what the organisation knowingly does with AI — but for what AI systems operating within its network do without explicit authorisation.
The practical response is not prohibition. Research consistently shows that banning AI tools drives shadow usage underground rather than eliminating it — and that providing enterprise-grade alternatives reduces unauthorised use by 89%. The response is governed adoption: build the visibility infrastructure to see what is happening, establish the classification framework to make rapid decisions about each tool, and provide legitimate alternatives that meet the productivity needs driving unsanctioned adoption in the first place.
The board that governs shadow AI effectively in 2026 is not the board that said “no.” It is the board that said “yes — and here is the framework within which the answer is yes.” Visibility first. Classification second. Sanctioned alternatives third. That sequence, executed with urgency, converts the shadow AI risk register into an enterprise AI competitive advantage.