Security Leaders Weigh In

Diana Kelley, Chief Information Security Officer at Noma Security:

The fact that 74% of organizations found more AI tools than they expected, and that actual workforce use was a median 58% versus an expected 33%, underscores the shadow AI reality that many organizations and CISOs are struggling with right now. That governance gap becomes more serious as AI continues to shift from people-driven use to agent-driven action that can access sensitive data, run code, and connect to other tools and services. To protect enterprise assets and information, security teams need visibility into what’s running, what data and systems those tools can access, and what agentic behavior is occurring at runtime. You can’t govern what you can’t see, and with agentic AI, unknown access can quickly become enterprise harm.

Randolph Barr, Chief Information Security Officer at Cequence Security:

The 74% number doesn’t shock me. Most organizations are still figuring out the basics: getting AI governance stood up, building an actual inventory, and doing all of it while leadership is pushing hard to adopt AI faster. Meanwhile, IT and security teams are wading through an endless parade of vendors promising to secure AI adoption and finding out too late that the tools don’t give them the visibility they actually need, or that they needed a foundational secure-AI program in place before buying anything at all.

And that pressure from the top is exactly what breeds shadow AI. Every department wants to improve how it works, sees AI as something to experiment with, and doesn’t think to loop in IT or security first. I’ve seen users spin up agents with their own credentials, connect to models nobody approved, and test against production data real, sensitive data. Here’s the part people miss: it used to be that rolling out an application required engineering or IT, and that requirement was a built-in checkpoint. AI erased it. Now anyone with a browser can wire up an agent over lunch.

So, what do you do about it? Start with the oldest rule in security: you can’t protect what you can’t see. If this research tells us anything, it’s that most organizations’ inventories are off by a mile. Get visibility into what’s actually running not what’s on the approved list.

Then, when you pick your first controls, choose the ones that let the business move fast. If governance feels like a roadblock, people will just route around it, and you're back where you started. The controls that matter most for agents live at the infrastructure layer: a control point between agents and everything they touch, so every action ties back to a real identity instead of somebody’s borrowed login; least-privilege scoping so an agent can only reach what it was explicitly trusted to touch; continuous discovery of which tools and MCP connections are actually live; and runtime enforcement with a full audit trail, so if an agent gets hijacked or wanders off script, the damage is contained and you know exactly what happened.

The goal isn’t to stop shadow AI after the fact. It’s to govern it from day one, so the business gets the speed it wants and security gets the visibility it needs.

Chris Radkowski, GRC Expert at Pathlock:

These findings mirror what we are seeing in our own research. Pathlock’s 2026 AI Governance Gap Report found that 51% of organizations are unsure whether they know all the AI agents operating in their enterprise systems. The problem is that AI adoption is accelerating faster than governance can keep up.

Discovery is an important first step, but it’s no longer enough on its own. AI agents operate continuously, interact directly with application APIs, and increasingly hold permissions to modify business records, execute cross-system workflows, and even approve transactions. An unknown or compromised agent with excessive privileges can create significant business risk at machine speed.

Security teams need to treat AI agents as identities, not just tools. That means maintaining an inventory of agents and their permissions, enforcing least-privilege access based on the specific business tasks they perform, and continuously monitoring their activity. Organizations also require transaction-level visibility, so they can answer not only ‘What is this agent allowed to do?’ but ‘What is it actually doing?’ across connected systems.

Organizations shouldn’t try to stop employees from adopting useful AI. The goal is making sure that adoption happens within security and governance frameworks, not outside them.

Gal Moyal, CTO Office at Noma Security:

Enterprise AI security is not determined by the volume or percentage of Shadow AI inside an organization. It is determined by whether a security team can discover ungoverned agents and tools, analyze their real-time behavior, and enforce contextual controls before malicious actions occur. Agentic risk has quickly evolved beyond agentic basics to include autonomous software agents and multi-agent swarms operating with persistent system permissions. These agentic systems can actively modify repositories, query sensitive data stores, and execute multi-step workflows using protocols like the Model Context Protocol (MCP).

Existing compliance audits, host-based security tools, and passive monitoring are insufficient for this new dynamic execution layer. Periodic compliance checks offer only a static snapshot, while autonomous agents constantly change their connection points and execution paths. Similarly, post-event monitoring and alerts leave a critical exposure window when interconnected agent swarms execute complex task chains in seconds.

If an attacker hijacks an agent through indirect prompt injection or a compromised skill, that exploit can spread across the orchestration framework instantly. 

Remaining secure while accelerating AI adoption requires inline, automated controls that evaluate behavioral context and block unauthorized tool calls prior to execution.

Limits of Legacy Security in Managing Shadow AI

Applying traditional security models to autonomous agent architectures creates critical operational gaps across existing toolsets:

• Static Audits vs. Dynamic Execution: Regulatory frameworks and periodic audits measure security posture at a fixed point in time. Autonomous swarms dynamically launch sub-agents, retrieving external knowledge, and utilize their integrations to external platforms during routine task execution. This constant behavioral adaptation renders static compliance checks outdated immediately after an audit.
• Latency in Alert-Based Detection: Passive monitoring tools generate logs or tickets for manual analyst review. In the time required for a Security Operations Center (SOC) team to triage an alert, an automated agent executing a multi-stage payload can map internal networks, exfiltrate sensitive data, and modify production systems.
• Lack of Intent Context in Traditional IAM: Standard Identity and Access Management (IAM) verifies whether a service account or a delegated identity has permissions to access a resource, but it cannot evaluate the intent behind a specific action or understand the context in a chain of actions. To put it simply, an agent might be privileged to remove a file, but that privilege can be abused to wipe the whole drive. The policy should be enforced at runtime behavior
• Invisibility to Endpoint Detection and Response (EDR): Traditional EDR tools monitor host-level processes, system calls, and file modifications, but they lack visibility into the agent’s context window, behavior and intent. Injection that resolves into in-band API calls through the agent’s own authorized client leaves no anomalous host artifact at all.

Recommended Actions: Core AI Security Team Capabilities for Secure AI Adoption

To allow your teams to adopt AI at speed without sacrificing security, security organizations should be able to deliver on three foundational capabilities with any security offering that are centered on visibility and behavioral control:

1. Behavioral Agent & Skill Discovery with AI-SPM: Extend discovery mechanisms beyond web traffic and static inventories to detect ungoverned agents, autonomous swarms, connected MCP servers, and shadow agent skills across the entire software supply chain in real time.
2. Protocol-Level Governance and Access Control: Enforce adaptive access controls between agents, orchestration frameworks, and downstream systems. Limit agent capabilities based on verified context and scoped permissions; additionally, require explicit authorization for high-risk operations such as arbitrary code execution or shell access.
3. Inline Behavioral Interception and Control with AI-DR: Transition from reactive alerts and logging to real-time inline AI Detection and Response (AI-DR). Automated analysis of prompts, responses, and tool calls as they occur to intercept and block unauthorized actions, prompt injection attacks, and data exfiltration inline before execution completes.