Why Shadow AI and AI Governance Need Evidence
Enterprise AI adoption is outpacing the speed at which security control frameworks can keep up. While generative AI, LLMs, and autonomous agents are being deployed across every corner of the workplace, security teams' efforts to inventory these assets and bring them into an approval process are often left behind.Shadow AI is the phenomenon that emerges from this gap. According to IBM's 2025 Cost of a Data Breach Report, 63% of organizations surveyed had no AI governance policy in place, and 20% had experienced a breach involving shadow AI. In other words, even where usage itself cannot be blocked, there remains a blind spot where usage isn't even tracked. At the same time, boards, auditors, and customers have begun demanding clear policies and evidence of controls around AI use. Yet most organizations are responding to this demand with spreadsheets, questionnaires, and manually collected data. This is the point at which AI governance stops being a matter of policy and becomes a matter of evidence.This article summarizes Qualys's published analysis of the AI governance evidence gap and the approach presented by Qualys TotalAI. ☑️ What Is Shadow AIShadow AI refers to unapproved AI tools that employees adopt and use without oversight from IT or security organizations. IBM's Cost of a Data Breach Report 2025 defines shadow AI this way, describing it as both a technical issue and an organizational culture issue. Under pressure to boost productivity, employees use AI tools without guidance and end up bypassing security procedures — uploading customer PII or company intellectual property in the process.Qualys extends the scope of detection further, to SaaS copilots, browser plugins, AI agents, MCP servers, code repositories, containers, and GPU environments. Because employee-level AI use and development-organization AI assets arise through different channels, failing to combine both into a single inventory leaves a gap between actual usage and the list of assets being managed. ☑️ Why AI Governance Has Become a Matter of EvidenceQualys defines the central challenge of AI governance as the "Evidence Gap." Policy documents, vendor questionnaires, and risk registers show what an organization has committed to doing — but they don't prove that AI systems are actually operating safely.The source material points out that security teams spend considerable time answering nearly identical questions repeatedly for different stakeholders:- Do you maintain an AI asset inventory?- How do you test your models?- What is the scope of access available to your AI agents?This burden isn't concentrated in one place — it's distributed across roles. Compliance and GRC staff handle vendor questionnaires and internal audits in parallel; AppSec and DevOps teams look for ways to insert AI checks into CI/CD pipelines; cloud and identity teams map AI-related permissions; and CISOs and risk executives have to translate all of this back into language suitable for board reporting. ☑️ The Real Scale of Shadow AI RiskShadow AI is a risk that shows up as cost. Per IBM's Cost of a Data Breach Report 2025, organizations with high levels of shadow AI use recorded breach costs averaging $670,000 more than organizations with little or no shadow AI. The same report put the global average breach cost at $4.44 million.The nature of the exposed data also differs. In breaches involving shadow AI, customer PII was compromised in 65% of cases — higher than the global average of 53% — and intellectual property was compromised in 40% of cases, versus a global average of 33%.Organizations' own AI assets aren't safe either. The same report found that 13% of organizations reported a breach involving an AI model or AI application, and of those, 97% lacked proper AI access controls.Vulnerabilities in the models themselves have also been confirmed. According to IBM data from November 2024, about 20% of generative AI jailbreak attempts succeeded, and successful attacks required attackers an average of 42 seconds and 5 interactions. Of the successful attacks, 90% led to data leakage.Attack attempts themselves are also increasing. The OWASP GenAI Security Project's "State of Agentic AI Security and Governance v2.01," published in June 2026, reported that prompt injection attempts rose 340% year over year, and that prompt injection remains the leading cause of agentic AI failures.Qualys also notes that when exposed information is sufficiently sensitive and an incident is judged material, unauthorized AI use can trigger SEC disclosure obligations. ☑️ Regulation Is Moving Toward Requiring EvidenceRegulators around the world are increasingly requiring demonstrable risk management and controls for AI.The EU AI Act (Regulation (EU) 2024/1689) requires risk management, logging, technical documentation, human oversight, and cybersecurity measures for high-risk AI systems. Fines vary by violation type: prohibited AI practice violations can reach up to €35 million or 7% of global annual revenue, while other violations — including obligations related to high-risk systems — can reach up to €15 million or 3%. That said, the EU AI Act applies its provisions on a staggered timeline, and the effective dates of some obligations were adjusted during 2026. Actual compliance timelines should be confirmed against the most current official sources at the time of reading.In the United States, NIST's AI Risk Management Framework (AI RMF) has become a de facto baseline for trustworthy AI, and states such as California and New York are tying their AI laws to NIST guidelines. Beyond these, reference frameworks continue to grow, including OWASP's Top 10 for LLM and MCP, MITRE ATLAS, ISO/IEC 42001, Singapore's AI guidelines, and CERT-In.In Korea, the "Framework Act on the Development of Artificial Intelligence and Establishment of Trust" took effect on January 22, 2026. This law establishes transparency and safety obligations centered on high-impact and generative AI.What these regulations share in common is a demand for risk management and evidence. Qualys frames the core question in a single line: How do we know our AI is safe?Answering that requires the same fundamentals as IT security — inventory, scanning, remediation, incident response — backed by continuous technical evidence that the controls are actually working. Policy documents alone are not enough. ☑️ Why Existing Security Tools Struggle to Prove AI RiskExisting security tools can scan infrastructure and monitor data movement, but they can't see how models and agents actually behave. Even in a fully patched environment, a single well-crafted prompt can expose sensitive information — and in that case, no clear failure signal appears on the infrastructure side. Point-in-time, snapshot-style assessments have a blind spot when it comes to AI's runtime behavior.AI risk surfaces at runtime — through prompts, model responses, agent actions, and excessive permissions. Without visibility spanning code, cloud, and browser, organizations struggle to answer even basic questions:- Where exactly is AI running?- Which models can leak information or be manipulated?- What are our agents capable of doing?- Can we prove our controls actually worked?No single tool category covers the full AI lifecycle. API scanners test known models but miss shadow AI. EDR and CNAPP platforms assess infrastructure but don't address inference behavior. CI/CD tools find code issues but can't enforce runtime safety.Qualys describes the essence of this situation as an absence of ground truth: compliance frameworks tell you what you should do, but not how to prove you're doing it. ☑️ The Four Pillars of AI Governance in Qualys TotalAIQualys TotalAI is a code-to-runtime AI security and governance solution built on top of Qualys's Enterprise TruRisk Platform, connecting four components into a single workflow. 1. Discover: Building an AI Asset InventoryGovernance starts with knowing exactly where AI exists.TotalAI continuously detects both approved and shadow AI across cloud services, GPUs, containers, code repositories, SaaS copilots, browser plugins, AI agents, and MCP servers. After identifying models, frameworks, and workloads, it maps each asset to its owner, operating context, exposure level, and access to core systems.Qualys describes this process as replacing static spreadsheets and self-reported lists with a real-time, auditable governance baseline. Once what's running, where it's running, who owns it, and whether it's approved are all consolidated into a single inventory, security teams and auditors gain the foundation they need. 2. Assess: A Three-Layer Check of Posture, Behavior, and RuntimeTotalAI combines vulnerability management, AI-specific testing, and real-time monitoring to assess AI risk, providing forensic evidence and a severity rating for each finding. Assessment operates across three layers.The posture layer identifies what's exposed and misconfigured — failed security and governance controls, cloud misconfigurations, vulnerable AI infrastructure, excessive access permissions, exposed models or MCP endpoints, and missing safeguards. The AI SaaS layer assesses the configuration, users, groups, and access permissions of supported AI SaaS tools, distinguishing approved use from shadow AI use. The AI code security layer detects exposed secrets, vulnerable dependencies, unsafe AI patterns, weak Cedar policies, and misconfigurations in repositories and CI/CD pipelines before deployment.The behavior layer actually tests whether AI can be manipulated. Adversarial testing against LLMs checks for prompt injection, jailbreaks, sensitive information disclosure, hallucination, unsafe outputs, multilingual and encoding-based attacks, denial of service, and multimodal manipulation. For MCP servers, it directly scans for tool poisoning, argument injection, SSRF, DNS rebinding, rug-pull attacks, unsafe file access, spoofing, command execution, and credential exposure. Each result is logged with the prompt, response, severity, pass/fail status, and — for successful jailbreaks — the technical evidence behind them.The runtime layer confirms what AI actually does after approval. By connecting code, Cedar policies, workloads, runtime, and behavior, it establishes what was built, deployed, permitted, and executed, using kernel-level eBPF instrumentation to verify what AI workloads actually do on the server. Combined with browser plugin telemetry and SaaS connectors, it identifies employees' approved and unapproved AI use, risky configurations, and sensitive data movement through prompts and uploads, while detecting posture drift and abnormal model or MCP activity after approval.Given that IBM's research found shadow AI-related breaches leak customer PII and intellectual property at higher-than-average rates, browser- and SaaS-layer visibility into data movement through prompts and uploads plays an outsized role in addressing shadow AI. 3. Remediate: Priority-Based Remediation GuidanceFindings alone don't reduce risk. TotalAI scores every AI issue using the Qualys TruRisk engine, factoring in vulnerability severity, data sensitivity, asset criticality, business context, model behavior, and runtime evidence. Qualys cites, as an example, a prompt injection found in a model with access to customer PII being assigned top priority.Each issue is routed to the relevant team based on its nature — cloud, DevOps, AppSec, identity, or GRC. Where behavioral controls have failed, it recommends changes to guardrails, prompts, retrieval logic, policy, or application design, generating platform-specific guardrails and necessary configurations while preserving attack evidence and maintaining a human approval step.After remediation is applied, retesting is performed and results are logged. Qualys describes this process as producing defensible evidence that risk was actually reduced, closing the loop from detection to remediation, verification, and documentation. 4. Governance: Audit-Ready ReportingTotalAI consolidates the AI inventory, posture scan results, test logs, and remediation status into unified dashboards and reports. This output addresses the questions auditors and executives actually ask: what AI systems do we have, which of them meet compliance requirements, and what issues remain?Reports can be exported mapped to frameworks such as the NIST AI RMF, EU AI Act requirements, FISMA, CMMC 2.0, OWASP Top 10 for LLM, and MITRE ATLAS — in a form that can be reused repeatedly for customer security questionnaires, vendor assessments, board reporting materials, and audit submissions.For federal agencies and contractors, TotalAI has received FedRAMP Moderate Authorization and can be deployed within the authorized boundary without an additional ATO process.TotalAI also runs on the same single platform that already handles cloud, vulnerability, and container risk, allowing AI risk to be treated as just another pillar of an existing security program — with results flowing into existing workflows without adding separate infrastructure or agents. ☑️ Points to Check When Considering AdoptionTranslating the above into practical considerations for adoption, here are some points worth checking.First, confirm whether the AI asset inventory is maintained through automated detection rather than self-reporting. Since shadow AI by definition bypasses the approval process, a self-reported list has inherent limits on coverage.Second, check whether infrastructure vulnerability scanning and model behavior testing are handled by separate tools and reporting systems. If the two are siloed, it becomes difficult to produce unified evidence.Third, confirm whether there's a way to capture AI usage at the browser and SaaS layer. Employee-level generative AI use arises through different channels than development-organization AI assets.Fourth, check whether retesting and documentation after remediation happen automatically. What audits require isn't a remediation plan — it's evidence that remediation was completed and verified.Fifth, confirm whether the resulting reports map to the frameworks your organization needs to address. Korean companies, in particular, often need to address both the domestic AI Framework Act and global regulatory requirements simultaneously. ☑️ FAQWhat is Shadow AI?
Shadow AI refers to unapproved AI tools that employees adopt and use without oversight from IT or security teams. Per IBM's Cost of a Data Breach Report 2025, 20% of organizations surveyed experienced a breach involving shadow AI, and organizations with high levels of shadow AI use recorded breach costs averaging $670,000 higher than those without.What is the AI governance evidence gap?
The AI governance evidence gap refers to a state where an organization has AI policies and completed questionnaires in place, but lacks continuous technical evidence that its models, agents, and AI workloads are actually being tested and controlled safely in production.Does Qualys TotalAI require a separate agent or infrastructure?
No. TotalAI leverages the existing Qualys Cloud Agent and cloud integrations, and can be used without new agents, code changes, or additional infrastructure.Which regulations and frameworks does TotalAI support?
It generates reports mapped to major requirements including the NIST AI RMF, EU AI Act, OWASP Top 10 for LLM, MITRE ATLAS, FISMA, and CMMC 2.0, and it has received FedRAMP Moderate Authorization. ☑️ ClosingIf it's unclear where AI assets — including shadow AI — exist and what they're doing, AI policy remains just a document. What boards, auditors, and regulators demand isn't the existence of a policy, but technical evidence that the controls are actually working. Finding AI assets, assessing the behavior of models and agents, and verifying and documenting remediation results all need to connect into a single process.Qualys TotalAI supports this process by connecting discovery, assessment, remediation, and governance reporting on a single platform. Because it operates on top of an existing Qualys environment without adding separate infrastructure or agents, organizations can start simply by finding out what AI is running in their environment. Cloud Networks, as a Qualys partner, supports the full journey from adoption review through deployment and operations. For inquiries about assessing your shadow AI landscape or building an AI governance framework, please contact Cloud Networks. ▶ Qualys Product Information [Sources: Qualys, "Operationalize AI Governance Across Shadow GenAI, MCP, and Agentic Workloads with Qualys TotalAI"; IBM, "Cost of a Data Breach Report 2025"; IBM, "AI jailbreak: Rooting out an evolving threat"; OWASP GenAI Security Project, "State of Agentic AI Security and Governance v2.01"; European Union, "Regulation (EU) 2024/1689 (EU AI Act)"; Korea Ministry of Government Legislation (National Law Information Center), "Framework Act on the Development of Artificial Intelligence and Establishment of Trust"]
August 06, 2026
