The Top-Down AI Plan Was Already Over
There's a strange comfort some security teams still take in AI rollout plans. Quarterly working groups. Approved model lists. A steering committee with a logo. The whole ritual implies AI adoption at your company starts when your company says it does.
It doesn't. Some of your engineers have been pasting stack traces into ChatGPT since late 2022. Legal has a copy-paste habit it can't break. Marketing runs campaign briefs through whatever model looked friendlier that week. This isn't a future state to plan for. It's the current state to govern. AI cybersecurity governance — the discipline of putting controls, visibility, and accountability around how AI actually gets used inside the company — is a response to that reality, not a strategy memo waiting on board approval.
Stop pretending you're deciding whether employees use AI. You aren't. You're deciding whether you can see them doing it.
What Is AI Governance, in Plain English?
Strip the jargon. AI governance comes down to three jobs: knowing which AI systems touch your data, deciding what each one is allowed to do with it, and being able to prove that decision held up when an auditor or a regulator asks.
What makes it harder than traditional IT governance is what happens to the data once it leaves. Shadow IT was, broadly, an inventory and storage problem. A file in someone's personal Dropbox is risky, but you can revoke the link, request deletion, retrieve the original. Shadow AI is different. The data gets processed, transformed, and in many cases absorbed into model training or passed to third-party subprocessors. ManageEngine's taxonomy of shadow AI calls this out precisely: data may persist beyond your control, may not be reversible once a model has learned from it, and may quietly alter downstream workflows through whatever the model produces next.
So the real governance question isn't "did someone upload something they shouldn't have." It's "what did that upload become, and where can it surface again?"
Why Shadow AI Isn't Just Shadow IT With a New Acronym
The shadow IT comparison is useful for exactly one reason: it shows where the analogy breaks.
An unsanctioned SaaS tool is a find-and-classify problem. Locate it, decide whether to sanction or block it, done. Shadow AI tools change the shape of the exposure. Fortinet's write-up on shadow AI is blunt about this: unlike earlier shadow IT, AI systems don't just store or transmit data, they process and reshape it, often outside managed environments, often driven by remote users on cloud-delivered apps. The endpoint isn't a laptop on a corporate LAN anymore. It's a browser tab at a coffee shop, signed into a personal account, talking to a vendor in another jurisdiction.
ManageEngine's team-by-team breakdown makes the risk land in a way policy documents usually don't. Development pastes source code, API keys, internal architecture docs. Legal pastes contracts and case strategy. HR pastes candidate profiles and salary data. Marketing pastes unreleased campaign material. Leadership pastes board decks. None of those groups think of themselves as a security problem. Every one of them is. The exposure isn't exotic. It's the most ordinary Tuesday in your org chart.
The 2023 Samsung incident keeps getting cited because of how boring it was. Engineers in the semiconductor division used ChatGPT to debug code and tidy meeting notes. Proprietary source code went to OpenAI's servers. Samsung's response — capping every employee prompt at 1,024 bytes after the fact — is the textbook reactive control that protects nothing already gone. Most shadow AI exposures never make the news for the simple reason that nobody files an incident report when the chatbot answers politely.
The Visibility Problem No Inventory Closes
Most security teams try to solve this the way they solved shadow IT. Build the list. Find the unknown tools. Add them to a register. Move on.
That approach breaks faster with AI agents than it did with SaaS. Cloud Security Alliance and Token Security's Autonomous but Not Controlled survey puts a number on the gap: 68% of organizations claim high visibility into their AI agents, yet a much smaller share can actually trace what those agents can reach. Most enterprises live in a "mostly visible" state — enough to operate day to day, nowhere near enough to enforce control models across every surface where employees create agents.
Mostly visible was tolerable when infrastructure was static. It isn't when agents can evolve through prompt changes, expand scope through integrations, and trigger side effects at machine speed without a human reviewing the action. A shadow agent inherits whatever permissions the workflow that created it already had. You cannot approve, log, scope, or revoke what you don't know exists. Every gap in visibility compounds into a governance gap that no policy document fills.
The CSA analysis is right that this isn't one review board or one ticketing process. Cloud platforms, internal orchestration tools, SaaS feature toggles, and LLM environments are all live agent surfaces now. Governance has to function across all of them, or it isn't governance.
Where AI Cybersecurity Governance Actually Begins
There's a version of "governance" that's just paperwork about AI, written to soothe the board. AI cybersecurity governance in the operational sense is something else. It's a layered control model that meets employee behavior where it already lives.
Fortinet's framing of the practical stack is the most useful one going: network-level visibility so you know what AI traffic leaves the environment; threat-intel coverage that maps AI services to risk classifications; and endpoint controls that enforce policy at the moment the data is typed. Extend the same visibility and policy enforcement off-network — remote users, unmanaged locations, browser-based AI apps — and you stop governing only the parts of the company that happen to be inside the perimeter. ManageEngine's product framing of the same problem is more specific and no less useful: monitor GenAI prompt activity, discover shadow AI tools, block unauthorized platforms by URL or by category (chatbots, AI writing assistants, code helpers), and stop personal-account access on corporate devices so usage flows through accounts you can actually audit.
Two principles keep showing up under any working model. First, treat every agent creation — in a developer environment, a SaaS toggle, an internal script — as a governance event with an owner, a purpose, and a permission scope. Second, build category-based controls, not manual blocklists. The blocklist is stale the day you publish it.
If your roadmap still opens with "define the approved AI stack," it's a roadmap for a company that doesn't exist. The company that exists has been experimenting for three years, in plaintext, in tools you can't see, against data you're legally responsible for. The top-down rollout plan isn't obsolete because it's trendy. It's obsolete because it's late.
