Tenable describes how shadow AI spreads and how to contain it
Original title: How to contain shadow AI, as it takes on multiple forms and spreads throughout your environment
IBM figures cited put shadow AI breach incidents at 43%, with an average cost of $5.39 million.
Tenable's Cybersecurity Awareness Month post says shadow AI now includes local models, coding assistants, agents, MCP servers, browser extensions and pasted source code, not only chatbots. It cites IBM's 2026 Cost of a Data Breach Report that incidents involving shadow AI assets rose to 43% from 20%, with an average cost of $5.39 million. Recommended steps are awareness training, an acceptable-use policy with approved tools, and treating shadow AI in exposure management. Tenable says its platform found about 62,000 AI-related exposures per customer over 30 days.
Unconfirmed: The incident rates, costs and exposure counts are figures reported by IBM, Thomson Reuters, the NCSC and Tenable, not independently verified here.
- IBM reported almost half of shadow AI incidents involved data loss or compromise.
- 42% caused operational disruption and 21% triggered regulatory fines, according to IBM.
- Thomson Reuters found 34% of employees knowingly used unapproved AI tools.
- Tenable reported 457 million AI-related issues across 7,000 customer environments.
Impact: Unapproved AI tools can expose data, disrupt operations, or draw fines
- 1.Add shadow AI to security awareness training and ask why staff use unsanctioned tools.
- 2.Publish an AI acceptable-use policy that lists approved tools.
- 3.Include shadow AI assets in a unified exposure management program.
- Vendors
- Tenable
- Products
- Tenable One
- Countries
- United Kingdom
From the original article
8 min read at tenable.com
Shadow AI used to be confined to a few simple scenarios, such as AI chatbots and AI browser extensions. Today, it spans a broad spectrum of complex vectors, making it harder to detect and control. In the latest installment of our Cybersecurity Awareness Month blog series, learn how employee security training, AI usage governance, and exposure management can help you tackle shadow AI successfully.
By Robert Huber · tenable.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.