More than half of workers have connected AI tools to work systems or apps without IT’s approval or knowledge, according to a BlackFog survey of 2,000 employees at companies with more than 500 staff. A mark of 51% changes what shadow AI actually means inside a company. For two years, the debate focused on staff pasting text into a public chatbot; today the more common case is a tool that reads the CRM, posts in team channels and queries internal files, all of it with the employee’s own credentials.
“Let’s say you have your official AI tool, which is ChatGPT or Claude, and you allow that tool to access certain applications and assets in the company,” said Mortada Ayad, VP Sales, META, at Delinea. “Then you discover there’s another fantastic tool that takes notes in your meetings. It’s not sanctioned by the company, but that tool also provides an integration with your Salesforce, your Slack and your business applications.”
Every action a tool like that takes is logged under the employee’s name. Access rules, audit trails and the policies staff sign all assume that the person who logged in is the person who acted. Delinea’s 2026 Identity Security Report, which surveyed 2,001 IT decision-makers in seven countries, found that 53% of organisations regularly find unsanctioned AI tools or agents accessing company systems or data. Only 28% can detect shadow AI in real time.
Agents now borrow employee identities
“When an unsanctioned AI agent acts inside an enterprise, it uses legitimate permissions, authentic interfaces, and standard APIs to perform everyday business tasks at machine velocity,” said Vibin Shaju, Vice President, EMEA Solutions Engineering at Trellix. “Detection must shift from simple threat identification to contextual, intent-aware behavioural analysis.”
“Sanctioned enterprise automations follow auditable, predictable paths,” Shaju added. “They run from verified cryptographic identities, use registered service accounts, execute deterministic scripts, and communicate through monitored enterprise gateways. By contrast, shadow AI typically hitches a ride on user tokens, browser extensions, or local command-line tools without central governance.”
Ayad and Shaju arrive at the same conclusion. When an employee and an agent share one identity, most security systems see a single actor. Each of the controls they describe gives the agent a separate presence: its own permissions, its own behaviour pattern and its own off switch, so that it can be governed without shutting down the person it works for.
Employees found the better tools first
In the 2026 PagerDuty Shadow AI Survey, 72% of office professionals said they understand how to use AI for their job better than the team that manages AI at their company. Wakefield Research ran the survey among 1,250 workers in Australia, Japan, the UK and the US. Two-thirds had used AI at work while believing policy did not allow it, and 89% of those who use AI at work first tried it outside work.
TrustedTech’s Shadow AI in the Workplace report found that about 70% of respondents believe AI tools have improved their team’s performance, and more than half save at least three hours a week. “The efficiency gains and personnel cost savings are too large to ignore, and override any security concerns,” said Darren Williams, founder and CEO of BlackFog, whose survey found that 60% of workers consider speed worth the security trade-off.
“There are so many useful AI tools today that are dedicated to fixing specific problems,” Ayad said. “I discovered recently that there is a tool that is amazing at note-taking, and that is all it does. The quality of the notes that come from it makes it almost too tempting not to use.” He was candid about why the pressure will last. “Users are becoming smarter and lazier, for good reasons, because they are more productive in a shorter time. They will always find ways to make their lives easier.”
Accountability falls on the person who signs
“Everyone in the chain has a responsibility, and I would even say an equal responsibility,” Ayad said. At his employer, staff re-sign the AI usage guidelines every six months because the tools change so quickly. He described what a breach would mean for him: “I can be fired if something bad happens from this. I would be held entirely accountable for it.”
In TrustedTech’s research, 65% of decision-makers use shadow AI, compared with 31% of employees below decision-maker level. BlackFog found that 69% of presidents and C-suite members appear to accept unsanctioned use. “Leadership teams are moving faster than the policies designed to guide them,” said Julian Hamood, Founder of TrustedTech. When executives use unapproved tools to move quickly, he added, “it creates a ripple effect across the entire organisation.”
PagerDuty found that 81% of workers believe AI rules are applied differently to leadership than to other staff, and 48% of employees who broke AI policies faced formal consequences such as warnings or discipline. So consequences fall mostly on the staff who sign the guidelines, while the most senior people use these tools at roughly twice the rate. “End users are relying on companies to make sure there is a proper way to approve tools and adopt them quickly and safely,” Ayad said.
Permissions belong to the agent
“Six months to a year ago, we didn’t have the proper way to restrict what an AI agent could do when it integrated with company assets,” Ayad said. “As long as it had the credential, it was possible to get that connection. There is no excuse today. Even from your Azure portal, you can restrict which tools can authenticate, connect and access assets.”
“For example, I can connect to my CRM with my full permissions, but when I use my agent to do that, it is only read-only access,” Ayad said. In his example, Delinea recognises the agent’s session even though it uses the employee’s credentials, and applies a narrower set of permissions at the moment of each request. Delinea has completed its acquisition of StrongDM, combining StrongDM’s just-in-time runtime authorisation with its own privileged access management. The combined platform evaluates each privileged action as it happens, whether a person or an AI agent is acting.
“Runtime authorisation and the whole concept of just-in-time and just-enough privileges applied only to people a few years ago,” Ayad said. “Now they apply to machines and humans alike.” Practice has some way to go. Delinea’s report found that 35% of organisations still give non-human identities and AI agents long-lived static credentials, compared with 17% that use just-in-time access and 8% that use ephemeral access.
“The agents themselves didn’t mean to do any harm. They had a goal,” Ayad said, referring to agent-related incidents at Amazon and Hugging Face. “You can’t control what the agent will do in terms of tasks and actions. What you can control is what it will be allowed to do if it accesses specific assets or data that you judge important.” He explained that a hijacked agent’s traffic would look entirely legitimate, which makes minimum necessary access the main safeguard that limits the damage.
“Detection engines must continuously ask, ‘Does this sequence of actions align with standard human workflow patterns, speed and stated business roles?’” Shaju said. He described the signals that tend to expose an agent working under a person’s login. One session might touch customer records, legal PDFs and code repositories within seconds. There may be bursts of clipboard activity or headless browser launches, or large volumes of outbound JSON payloads sent to public model APIs from endpoints without approved integration certificates.
“Those EPM solutions are continuously aware of what’s running on the user’s machine,” Ayad said, describing endpoint privilege management on company-managed devices. Personal devices that use company credentials need a second layer: proxy technology that sits between users and the assets they reach. “They can make the difference between my user traffic and my agent traffic,” he said. “Even if we use the same identity in the two sessions, they can detect whether it is my AI agent behind the authentication.”
Containment can leave the employee working
“Containment must be surgical,” Shaju said. “Traditional incident response, such as revoking an employee’s enterprise identity or severing their entire network access, can halt business operations and alert attackers.” Trellix Wise draws role and reporting-line data from systems such as Workday to judge what normal behaviour looks like, then acts only on the agent. It can revoke the affected OAuth tokens, end specific unauthorised processes on the endpoint, or block connections to unapproved model endpoints, and the employee’s legitimate sessions keep running.
“This information is already in organisation data lakes such as SIEM and Elastic,” Shaju said, explaining that endpoint, email and data loss prevention telemetry can be pieced into a single timeline. “Such a machine-assisted analyst proves whether an action was an intentional employee initiative, an external prompt injection compromise, or an agent acting erratically.” That answer decides what happens to the employee, and he noted that the process keeps human oversight in the loop “so the wider enterprise isn’t unnecessarily paralysed.”
“A gap between AI adoption and oversight already exists,” said Suja Viswesan, VP, Security and Runtime Products at IBM, when the company released its Cost of a Data Breach Report 2025. The report found that one in five organisations had a breach linked to shadow AI, and those with high levels of it paid $670,000 more per breach on average. It also found that 97% of organisations with an AI-related breach had no AI access controls in place. On that evidence, the cost comes from missing controls more than from the tools themselves.
“The most important and basic control will remain, and it will always be on the identity,” Ayad said. “When more and more companies can control the permissions of the identities being used anywhere, by humans or agents, to access their systems, they will naturally reduce that risk.” He added that user education still matters. “It is important to educate and bring awareness, but you still have to have those controls in place.”
Ayad is taking the approved route for Granola himself. “I want to use that tool so badly in my organisation,” he said. “The way I’m doing it right now is by making sure I get the approval from whoever in the cybersecurity team is in charge of approving that tool, so that I can start using it.”
