Resources

AI governance for security-conscious organizations

Our articles, press, and research on Shadow AI, governance, and safely putting AI to work in the enterprise.

Agentic AI

MCP Servers Are the New Shadow AI Surface

A coding agent with MCP servers attached is a developer's credentials, wired to a model, controlled by a JSON file on a laptop. Why MCP is the shadow AI surface security teams are not looking at yet, and how to govern it.

Agentic AI

Your Agents Are Shadow AI With Credentials

AI agents are the third kind of AI in your company, and the least watched. Why an agent behaves like shadow AI with credentials, the ordinary ways it goes wrong, and how to bring it under governance.

AI Governance

Shadow AI Is Only a Third of the Problem

Shadow AI is only one of three kinds of AI usage in most organizations. A practical guide to seeing unsanctioned, sanctioned, and programmatic AI, and why the NIST "Identify" step has to come first.