- Tenable, citing IBM's 2026 report, says security incidents involving shadow AI assets reached 43%, against 20% last year. Tenable does not give the base population or method.
- Tenable says shadow AI now includes agents, local models and tool servers. A policy written only for chatbots would not cover them.
- Tenable advises publishing approved tools. The UK's NCSC advises raising awareness and understanding employees' needs. Tenable says blocking by default tends to backfire.
The rule you wrote for chatbots no longer fits
Tenable says shadow AI used to mean mostly employees oversharing work information with a personal chatbot. Its security researchers say that picture is out of date. In an October 22 blog post, they describe a wider set of AI assets that are harder to spot and harder to control.
The lesson here is that the unit of risk may have changed. It used to be a person typing into a window. Tenable's argument is that it can now be software that holds access and acts for a person. The teams that own the data may not see it.
What the numbers say
Tenable cites IBM's 2026 Cost of a Data Breach Report. Tenable says security incidents involving shadow AI assets reached 43%, compared with 20% last year. Tenable's blog does not say which population that share covers. It does not describe the survey method either. Read the figure as a direction, not a precise rate.
Tenable also reports IBM's cost figure. Breaches linked to shadow AI averaged $5.39 million. That is about $400,000 more than the global average.
Tenable adds a measurement of its own. Over 30 days earlier this year, its platform ran 274 detection plugins built for AI across 7,000 customer environments. It found 457 million security issues. Tenable divides that out to roughly 62,000 AI-related exposures for each customer.
Be careful with that number. It counts findings from AI-specific checks. It is not a count of unsanctioned tools. Tenable does not say how many of the findings involve shadow AI.
Tenable's post does not break either set of figures out by agents, MCP servers or other new forms. The claim that shadow AI now takes these forms is Tenable's own framing.
Two more cautions apply. Tenable sells exposure management software, so it has a stake in the problem looking large. And the 7,000 environments are Tenable customers, not a random sample of companies.
How the new forms work
Tenable names many forms of shadow AI. They include code assistants, local models, agents, embedded features, browser extensions and MCP servers. It illustrates the problem with six workday scenarios. These are Tenable's examples, not reported incidents.
An MCP server is a small connector. It lets an AI assistant read from and act on other systems. Tenable's first scenario has a marketing manager who adds an open-source connector nobody has vetted. It secretly links his desktop assistant to the company's internal customer database. IT and security teams never hear of it.
A browser extension is the second case. A sales executive downloads a free tool to summarize web pages. In Tenable's telling, the add-on quietly lets a third party view her private CRM dashboards.
Another case involves credentials. A business analyst gives broad administrative access to a consumer AI agent. The agent is meant to crawl the company's private data warehouse.
Another scenario involves an engineer who sidesteps software restrictions to run an unvetted model locally. Tenable says this leaves a blind spot for endpoint security. Those are the tools that watch individual laptops and servers.
The pattern is that the AI is not the only risk. The access handed to it is. An agent holding a person's credentials can reach whatever that person can reach.
Why staff do it
Tenable points to survey evidence that much of this is deliberate. In Thomson Reuters' Future of Professionals 2026 report, 34% of employees admitted knowingly using AI tools their organization had not approved. Thomson Reuters links this to frustration with "the quality of sanctioned tools or the lack of a clear AI strategy."
Deloitte's GenAI Workforce Survey found that 31% of UK employees use AI tools without their organization's permission. Tenable also notes the UK government's point about a gap. Staff adopt AI fast, while organizations lag in approving tools and setting policy.
The Cloud Security Alliance describes an "invisible layer of AI infrastructure" that has not been inventoried. It says such assets sit outside policy enforcement, access controls and audits.
Thomson Reuters attributes this behavior to frustration with approved tools that fall short or with a missing AI strategy. If so, a ban treats the symptom and leaves the cause.
What Tenable and the UK's NCSC recommend
Tenable's advice starts with people. It says to add shadow AI to security awareness training and to favor education over punishment. It also suggests asking business unit leaders which AI tools they use and why.
The UK's National Cyber Security Centre points the same way. An NCSC cloud researcher wrote that raising awareness and understanding employees' needs helps them gain the benefits of new tools while using them securely.
Tenable warns that "block by default" policies tend to backfire. They push use further out of sight, especially when the tools raise productivity. It recommends an acceptable use policy instead. The policy should say who may use AI, which tools and what data.
Tenable also advises naming who is accountable and setting an approval process for new tools. It says to publish a list of authorized tools. The policy should be revised as usage changes. The publishing advice is Tenable's. The NCSC passage quoted here does not mention it.
Tenable also argues against handling shadow AI with isolated point tools. It wants AI findings correlated with other exposure data to reveal attack paths. That is the vendor's own position. Buyers should test it against the tools they already own.
Questions to put to your team
Ask which MCP servers, browser extensions and local models are running today. Ask who approved each one. Ask which AI agents hold employee credentials and how broad that access is.
Ask what staff have said about the approved tools' shortcomings. Ask whether anyone owns fixing them.
Then check whether your policy names agents and connectors, or only chatbots. A rule written for one form of AI will miss the others. The tools staff reach for show what the sanctioned ones lack.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Tenable.
