AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

5 Steps to Managing Shadow AI Tools Without Slowing Down Employees

infonews

securitypolicy

Source: BleepingComputerMay 18, 2026

Summary

Shadow AI refers to unapproved AI tools that employees use at work without IT oversight, often gaining access to corporate data through quick login approvals that bypass traditional security monitoring. The article explains that 80% of employees use unapproved generative AI applications, and most companies lack formal AI governance policies, creating a visibility gap for security teams. The source describes a five-step program to manage this risk by discovering which tools are running, creating employee-friendly policies, and establishing approved alternatives.

Solution / Mitigation

The source explicitly recommends a five-step program: (1) discover all AI tools in use by auditing OAuth (authorization tokens that grant app access to data) connections, scanning for browser extensions, identifying AI features in already-approved tools, and surveying employees; (2) write a practical policy listing approved tools, specifying which data categories (customer records, source code, financial information) should never enter AI tools, confirming data training opt-out status for sensitive tools, and defining a process for requesting new tools; (3-5) [the source text is incomplete and does not provide steps 3-5]. Implement steps 1-2 to give security teams visibility while providing employees a clear approved path for AI tool adoption.