From: Andrew Hughes via Dg-shadow-ai <dg-shadow-ai@kantarainitiative.org>
Date: Wednesday, September 16, 2026 at 4:08 AM
To: This mailing list is for the Shadow AI Discussion Group communications. <dg-shadow-ai@kantarainitiative.org>; Alec Laws <alec@identos.ca>
Cc: Andrew Hughes <andrewhughes3000@gmail.com>
Subject: [Dg-shadow-ai] Fwd: Nobody Signed Off on What's Already Running
This Message is From an External Sender
Caution: Do not click links or open attachments unless you recognize the sender and know the content is safe.
Hi Shadow AI DG - this just crossed my inbox and I think it might be relevant to your work.
Perhaps reaching out to the analysts and checking if they are aware of the DG's work? Might be possible to leverage KC's buzz to get more participants?
andrew.
————————
----- Original message -----
Subject: Nobody Signed Off on What's Already Running
Date: Wednesday, September 16, 2026 12:53
|
|
|
KC INSIGHTS
|
|
16th September 2026
|
|
Nobody Signed Off on
What’s Already Running
New research treats shadow SaaS and shadow AI as one problem for the first time. A CISO who’s led three very different security organizations agrees.
Why SaaS and AI governance are now one market | What a CISO actually trusts AI to decide | Who gets to act on behalf of your AI agents
Hi Andrew,
Our newest research
closes a gap that has been building for years. Matthew Gardiner’s Leadership Compass and Buyer’s Compass on SaaS Security and AI Governance stop scoring these as separate markets, because AI is now delivered through SaaS and embedded inside it, and both create
identities, service accounts, integrations, and agents that nobody explicitly owns.
This edition’s Analyst Chat makes the practical case. Matthew Gardiner and Matthias Reinwarth walk through why most organizations
still cannot say how many SaaS and AI tools are actually running inside their environment, and why discovery, not policy, is the capability everything else depends on.
From the CISO seat, Michael Schrank, who’s led security at Deutsche Bank, Daimler, and Adidas, tells Berthold Kerl much the
same thing from a different angle: AI is already changing what security teams can safely automate, but autonomous action only earns trust where the business context behind it is actually understood.
|
|
Market Insights
|
Leadership Compass + Buyer’s Compass 
SaaS Security and AI Governance
Matthew Gardiner rates vendors in a market that’s stopped treating SaaS security and AI governance as separate disciplines, evaluating how well platforms discover shadow SaaS and shadow AI alike, and
whether they extend identity-based controls to AI agents as full-fledged identities in their own right.
|
|
Expert Voices
|
CISO Perspective 
Full Steam Ahead: AI, Attackers, and Why CISOs Must Keep Pace
Berthold Kerl talks with Michael Schrank about where AI is already earning measurable value in cyber defense and GRC, where it’s still overhyped, and why entry-level security roles are disappearing faster
than the industry planned for.
|
|
|
|
Analyst Chat 
Shadow SaaS, Shadow AI & the Governance Gap
Matthew Gardiner and Matthias Reinwarth on why SaaS Security Posture Management has quietly become the wrong frame, and why most SaaS and AI applications inside a typical organization are still invisible
to the team meant to secure them.
|
|
|
Three Weeks Out
|
AIdentity & Non-Human Identity Impact Day
Machine, workload and AI agent identities at scale: a discussion on governing delegation as autonomous agents take on more of the work, based on themes from this month's agent-delegation webinar.
|
|
Webinar Briefings
|
September 22 
The New Workforce Identity Challenge: AI Agents, NHIs, and the IAM Gap
A direct continuation of this edition’s core question, for teams ready to move from “we found the agents” to “we can govern them.”
|
|
|
|
September 29 
Who Gave the Agent Permission?
Jonathan Care, Grace Rachmany from the Decentralized Identity Foundation, and Angelika Steinacker on scoped, revocable mandates for AI agents, and building an evidence trail that connects an agent’s actions
back to whoever authorized them.
|
|
KuppingerCole Analysts Membership
Every piece of research in this edition, and a complimentary ticket to AIdentity & NHI Impact Day, come with Expert Membership.
|
|
