Managing Shadow AI Risk – Bitdefender TechZone

Consider an organization that had done what the market recommends: it evaluated AI vendors, selected one, paid for it, and rolled it out under corporate licensing with IT approval. Yet while that sanctioned deployment was live, staff at the same organization had used multiple other unsanctioned LLM services, including DeepSeek and voice-cloning tools. The critical detail is that they did so alongside an approved tool funded and supported by procurement.

When the phenomenon of "shadow AI" emerges, it is reflexively viewed as an issue of availability. The main reason that employees turned to unauthorized tools is because official solutions were missing the right functionality. Employees select whichever tool is closest to the task in front of them. DeepSeek and voice-cloning tools are not substitutes for a general-purpose assistant. Procurement reviews data security posture, negotiates confidentiality agreements, and verifies compliance certifications—all real safeguards against the wrong problem.

To create a full picture of AI usage, you can use tools like GravityZone AI Visibility and Control (AIVC) that report the AI services on managed endpoints. In Bitdefender's 2026 Cybersecurity Assessment, 47.4% of respondents acknowledged only partial or no visibility into shadow AI tools and personal AI accounts used for work, and managers reported full visibility markedly more often than the practitioners in the same organizations — 57.8% compared to 45.9%.

Verizon Data Breach Investigations Report, May 2026 shows the pattern at scale. Shadow AI is now the third most common non-malicious insider action in the data loss prevention dataset, a fourfold increase over the previous year. Regular AI usage on corporate devices, whether authorized or not, reached 45% of employees against 15% in the prior year.

Fig. 1. Regular AI users on corporate devices

The critical visibility gap: 67% of those users access AI services through non-corporate accounts on corporate devices. This is the mechanism that makes the rest invisible. A corporate account produces an audit trail: the organization can query usage, review retention settings, enforce enterprise terms, and in most cases contractually exclude submitted content from model training. A personal account on a corporate endpoint produces nothing the organization can query. The data leaves through a browser session or a desktop agent. In this case, the enterprise agreement the legal team negotiated does not apply, because the employee is not operating under it.

Fig. 2. Shadow AI as a non-malicious insider DLP action

Bitdefender AIVC reports what AI software is present and running on a managed machine regardless of which account it is signed into, making mentioned 67% visible.

Shadow AI moves three categories of business-critical data, each with distinct consequences.

The coding assistant is where these three meet: it runs inside an editor that already holds the repository, and frequently the configuration files and credentials sitting in the same working directory. Bitdefender AIVC lists these under its Coding category, including the ones installed as editor extensions.

The motive matters for control design. In the Verizon DBIR, Convenience leads the motives in the Privilege Misuse pattern at 60%, ahead of Financial at 33%. Insider threat programs are created for an adversary, applied to internal users whose motive is finishing work faster, those controls doing nothing about the risk that produced the behavior. At the same time those controls produce more workarounds and user creativity. The employee blocked from one service does not stop; they find the one that is not blocked yet, which is by definition the service the security team knows least about.

The OWASP GenAI project publishes two current risk taxonomies: the OWASP LLM Top 10 2026 and the OWASP Top 10 for Agentic Applications 2026. Six entries across the two describe risks that organizations create through their own deployment and configuration decisions.

Fig. 6. Six OWASP GenAI entries that organizations create through deployment and configuration decisions

The thread connecting all six is the same. Each describes a permission or configuration decision the organization made, not an attack it suffered. Four of the six are permission decisions taken at deployment, which is also where they are cheapest to reverse. PHASR addresses them at that point by giving an AI agent a behavioral profile of its own, separate from the user operating the endpoint, so the agent’s reach is scoped to its tasks rather than inherited from whoever installed it.

The European Commission began enforcing the EU AI Act’s transparency rules, and the enforcement powers attached to them, in August 2026. The Act’s provisions phase in across several dates, so this is not the whole regime arriving at once. What is live now is specific: AI chatbots must identify themselves as AI, and AI-generated content must be labeled.

Regulation converts the inventory problem from a security preference into a compliance obligation. Transparency and documentation requirements presuppose that an organization knows which AI systems it operates. An organization that cannot enumerate its AI systems cannot label AI-generated content.

An inventory built once is a snapshot; keeping it current means turning shadow AI into visibility.

Every signal here is scoped to managed endpoints, corporate identities, and sanctioned tenants. A personal device on a personal network falls outside all of it.

Attribution is what makes that third signal usable. PHASR identifies an AI agent through a maintained list of known agent binaries combined with process lineage, so a process started directly or indirectly by a known agent parent is evaluated as the agent’s activity rather than the user’s. Without it, agent-spawned and user-run commands arrive in the same session, indistinguishable.

The sequence below is ordered deliberately, and the ordering is itself the recommendation: instrument first, govern second.

Immediate. Inventory every AI tool in use, including the ones nobody approved. Triage that inventory on two axes, not one: what is misconfigured, and what was never sanctioned. The second list is longer, and nothing on the endpoint can generate it for you. Run the discovery on the endpoint rather than from a vendor console or a staff survey: the Verizon Data Breach Investigations Report found that 67% of employees using AI on corporate devices do so through non-corporate accounts, which leave no record in any enterprise tenant an administrator can query, and a survey measures only what people are willing to report. Endpoint discovery has three surfaces — installed software and browser extensions, outbound connections to known AI service domains, and locally running processes belonging to agent frameworks and Model Context Protocol (MCP) servers, the connectors that hand an AI tool access to another system. The third surface is the one most organizations have never looked for, and where the highest-privilege software will be found, because an agent framework runs with the permissions of whoever installed it. Alongside the inventory, classify the data sensitivity levels in the environment and extend content inspection policies to cover uploads to AI services, which most policies written before 2025 do not enumerate.

Short-term. Write the AI governance policy against the inventory rather than against assumptions. A policy drafted from what endpoint discovery actually found will govern the tools employees use, which is a different list from the one a policy template anticipates. Review any deployment where an AI system acts on its own — installing software, calling APIs, running commands — against the OWASP Top 10 for Agentic Applications, and treat installing one as a change control event rather than a software preference.

Strategic. Move from a point-in-time inventory to continuous monitoring of AI data flows. Shadow AI quadrupled year over year in Verizon's data loss prevention data, so an inventory compiled once is out of date by the time it is finished. Separate the permissions an AI agent holds from the permissions of the employee whose endpoint it runs on, so that granting an agent the tools its task requires does not silently widen what the person can reach — in GravityZone this is PHASR for AI agents, which treats each agent as a behavioral profile of its own. Align the acceptable-use framework with whichever transparency and documentation obligations apply in the jurisdictions you operate in, so that the security inventory and the compliance record are the same document.

Finding shadow AI and acting on it are two different jobs, and Bitdefender GravityZone separates them deliberately. AI Visibility and Control produces the inventory and the ranked findings; Web Content Filtering, custom detection rules, and PHASR act on what it finds.

AI Visibility and Control (AIVC) runs on the Bitdefender Endpoint Security Tools agent already deployed on protected Windows endpoints. Collection is minimized by design — the agent records what AI software is present and how it is configured, not prompts, chat history, model weights, credentials, or file content. Two views carry the output: AI Services for what is running, and AI Findings for what to look at first, each backed by endpoint-specific evidence that gives an investigation a host set to pivot from. Keep in mind that a service can appear in AI Services with no findings at all. That means nothing technically wrong was detected, not that the service is approved: whether a clean but unsanctioned tool is acceptable is a question the organization's security policy answers, not the risk score.

Fig. 7. One endpoint, four paths: what AIVC discovers, what the administrator decides, and which control enforces it.

Enforcement is where the separate controls come in. Web Content Filtering blocks the services the organization prohibits. Custom detection rules match a named tool on process name with Kill process attached, so later appearances need no administrator in the loop. PHASR reduces what an installed tool may do, blocking individual actions rather than whole programs. PHASR for AI agents draws the permission boundary, treating each agent as a behavioral profile of its own.

Fig. 8. Process lineage attributes an agent’s activity to the agent’s own profile rather than to the user’s session

Contractor laptops, personal phones, and other unmanaged machines sit outside that inventory, and browser-reachable assistants are exactly the kind of tool used from them. No endpoint or network control closes that gap: a personal account on a personal device produces no record an organization can query.

The solution is to make the official path attractive enough that using unauthorized solutions is no longer worthwhile; people turn to so-called "shadow AI" to overcome obstacles, and this approach removes those obstilces.