Hi Shadow AI DG - this just crossed my inbox and I think it might be relevant to your work. Perhaps reaching out to the analysts and checking if they are aware of the DG's work? Might be possible to leverage KC's buzz to get more participants? andrew. ———————— *Andrew Hughes* m +1 250.888.9474 AndrewHughes3000@gmail.com ----- Original message ----- From: KuppingerCole Analysts <service@kuppingercole.com> To: andrew@facetec.com Subject: Nobody Signed Off on What's Already Running Date: Wednesday, September 16, 2026 12:53 New research treats shadow SaaS and shadow AI as one problem for the first time, plus what a CISO trusts AI to decide. View Online <https://go.kuppingercole.com/webmail/898881/816323196/39c2ce481d099d5cb4deb2ba7ee789292c679b28ca0a8513672ef9e87b074f38> [image: KuppingerCole Analysts] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2myj/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> *KC INSIGHTS* *16th September 2026* *Nobody Signed Off on What’s Already Running**New research treats shadow SaaS and shadow AI as one problem for the first time. A CISO who’s led three very different security organizations agrees.* Why SaaS and AI governance are now one market | What a CISO actually trusts AI to decide | Who gets to act on behalf of your AI agents Hi Andrew, Our newest research closes a gap that has been building for years. Matthew Gardiner’s Leadership Compass and Buyer’s Compass on SaaS Security and AI Governance stop scoring these as separate markets, because AI is now delivered through SaaS and embedded inside it, and both create identities, service accounts, integrations, and agents that nobody explicitly owns. This edition’s Analyst Chat makes the practical case. Matthew Gardiner and Matthias Reinwarth walk through why most organizations still cannot say how many SaaS and AI tools are actually running inside their environment, and why discovery, not policy, is the capability everything else depends on. From the CISO seat, Michael Schrank, who’s led security at Deutsche Bank, Daimler, and Adidas, tells Berthold Kerl much the same thing from a different angle: AI is already changing what security teams can safely automate, but autonomous action only earns trust where the business context behind it is actually understood. Market Insights Leadership Compass + Buyer’s Compass [image: Leadership Compass and Buyer’s Compass: SaaS Security and AI Governance] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2mxq/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo>SaaS Security and AI Governance Matthew Gardiner rates vendors in a market that’s stopped treating SaaS security and AI governance as separate disciplines, evaluating how well platforms discover shadow SaaS and shadow AI alike, and whether they extend identity-based controls to AI agents as full-fledged identities in their own right. Read the Leadership Compass → <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2mxq/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Read the Buyer’s Compass → <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2mxt/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Expert Voices CISO Perspective [image: The CISO Perspective Episode 07 with Michael Schrank] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2mxx/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo>Full Steam Ahead: AI, Attackers, and Why CISOs Must Keep Pace Berthold Kerl talks with Michael Schrank about where AI is already earning measurable value in cyber defense and GRC, where it’s still overhyped, and why entry-level security roles are disappearing faster than the industry planned for. Watch Now → <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2mxx/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Analyst Chat [image: Analyst Chat 315: Know Your Shadow] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my1/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo>Shadow SaaS, Shadow AI & the Governance Gap Matthew Gardiner and Matthias Reinwarth on why SaaS Security Posture Management has quietly become the wrong frame, and why most SaaS and AI applications inside a typical organization are still invisible to the team meant to secure them. Watch Now → <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my1/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Three Weeks Out [image: AIdentity and Non-Human Identity Impact Day: Digital Trust Beyond Humans] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my4/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo>AIdentity & Non-Human Identity Impact Day Machine, workload and AI agent identities at scale: a discussion on governing delegation as autonomous agents take on more of the work, based on themes from this month's agent-delegation webinar. Register Now → <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my4/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Webinar Briefings September 22 [image: The New Workforce Identity Challenge webinar] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my7/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo>The New Workforce Identity Challenge: AI Agents, NHIs, and the IAM Gap A direct continuation of this edition’s core question, for teams ready to move from “we found the agents” to “we can govern them.” Register Now → <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my7/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> September 29 [image: Road to Impact Day webinar: Who Gave the Agent Permission?] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2myb/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo>Who Gave the Agent Permission? Jonathan Care, Grace Rachmany from the Decentralized Identity Foundation, and Angelika Steinacker on scoped, revocable mandates for AI agents, and building an evidence trail that connects an agent’s actions back to whoever authorized them. Register Now → <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2myb/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> KuppingerCole Analysts Membership Every piece of research in this edition, and a complimentary ticket to AIdentity & NHI Impact Day, come with Expert Membership. Explore KuppingerCole Membership → <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2myf/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> *Copyright © 2026, All rights reserved.* KuppingerCole Analysts AG | Wilhelmstr. 20-22 <https://www.google.com/maps/search/Wilhelmstr.+20-22?entry=gmail&source=g> | 65185 Wiesbaden | Germany <https://go.kuppingercole.com/e/898881/l-898881-2025-08-19-g81cc/h2mym/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Amtsgericht Wiesbaden HRB 29536 Board of Management (Vorstand): Berthold Kerl (CEO), Bettina Buthmann, Oliver Schnürle Supervisory Board (Aufsichtsrat): Michel Roux (Chairman), Prof. Dr.-Ing. Ralph Bruder, Eve Maler Imprint <https://go.kuppingercole.com/e/898881/imprint/h2myq/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> | Privacy Policy <https://go.kuppingercole.com/e/898881/privacy/h2myt/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> www.kuppingercole.com <https://go.kuppingercole.com/e/898881/2026-09-16/h2myx/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Unsubscribe <https://go.kuppingercole.com/Email-Preference-Center?ehash=39c2ce481d099d5cb4deb2ba7ee789292c679b28ca0a8513672ef9e87b074f38&email_id=816323196&epc_hash=QU1MTPUalteDOKkwdvJCyDi-c4L16Ps3aHSlS5s-95c>
Thanks for the note Andrew! I will look into what KC is working on in this space. I have a few webinar coming up that might also be of interest. Who Gave the Agent Permission? Delegated Authority, Trust & Accountability in Agentic AI<https://www.kuppingercole.com/events/2026/09/ai-agent-governance?utm_source=pardot> It all ties together. Best, Chris From: Andrew Hughes via Dg-shadow-ai <dg-shadow-ai@kantarainitiative.org> Date: Wednesday, September 16, 2026 at 4:08 AM To: This mailing list is for the Shadow AI Discussion Group communications. <dg-shadow-ai@kantarainitiative.org>; Alec Laws <alec@identos.ca> Cc: Andrew Hughes <andrewhughes3000@gmail.com> Subject: [Dg-shadow-ai] Fwd: Nobody Signed Off on What's Already Running This Message is From an External Sender Caution: Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi Shadow AI DG - this just crossed my inbox and I think it might be relevant to your work. Perhaps reaching out to the analysts and checking if they are aware of the DG's work? Might be possible to leverage KC's buzz to get more participants? andrew. ———————— Andrew Hughes m +1 250.888.9474 AndrewHughes3000@gmail.com<mailto:AndrewHughes3000@gmail.com> ----- Original message ----- From: KuppingerCole Analysts <service@kuppingercole.com<mailto:service@kuppingercole.com>> To: andrew@facetec.com<mailto:andrew@facetec.com> Subject: Nobody Signed Off on What's Already Running Date: Wednesday, September 16, 2026 12:53 View Online<https://go.kuppingercole.com/webmail/898881/816323196/39c2ce481d099d5cb4deb2ba7ee789292c679b28ca0a8513672ef9e87b074f38> [KuppingerCole Analysts]<https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2myj/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> KC INSIGHTS 16th September 2026 Nobody Signed Off on What’s Already Running New research treats shadow SaaS and shadow AI as one problem for the first time. A CISO who’s led three very different security organizations agrees. Why SaaS and AI governance are now one market | What a CISO actually trusts AI to decide | Who gets to act on behalf of your AI agents Hi Andrew, Our newest research closes a gap that has been building for years. Matthew Gardiner’s Leadership Compass and Buyer’s Compass on SaaS Security and AI Governance stop scoring these as separate markets, because AI is now delivered through SaaS and embedded inside it, and both create identities, service accounts, integrations, and agents that nobody explicitly owns. This edition’s Analyst Chat makes the practical case. Matthew Gardiner and Matthias Reinwarth walk through why most organizations still cannot say how many SaaS and AI tools are actually running inside their environment, and why discovery, not policy, is the capability everything else depends on. From the CISO seat, Michael Schrank, who’s led security at Deutsche Bank, Daimler, and Adidas, tells Berthold Kerl much the same thing from a different angle: AI is already changing what security teams can safely automate, but autonomous action only earns trust where the business context behind it is actually understood. Market Insights Leadership Compass + Buyer’s Compass [Leadership Compass and Buyer’s Compass: SaaS Security and AI Governance] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2mxq/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> SaaS Security and AI Governance Matthew Gardiner rates vendors in a market that’s stopped treating SaaS security and AI governance as separate disciplines, evaluating how well platforms discover shadow SaaS and shadow AI alike, and whether they extend identity-based controls to AI agents as full-fledged identities in their own right. Read the Leadership Compass →<https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2mxq/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Read the Buyer’s Compass →<https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2mxt/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Expert Voices CISO Perspective [The CISO Perspective Episode 07 with Michael Schrank] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2mxx/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Full Steam Ahead: AI, Attackers, and Why CISOs Must Keep Pace Berthold Kerl talks with Michael Schrank about where AI is already earning measurable value in cyber defense and GRC, where it’s still overhyped, and why entry-level security roles are disappearing faster than the industry planned for. Watch Now →<https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2mxx/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Analyst Chat [Analyst Chat 315: Know Your Shadow] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my1/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Shadow SaaS, Shadow AI & the Governance Gap Matthew Gardiner and Matthias Reinwarth on why SaaS Security Posture Management has quietly become the wrong frame, and why most SaaS and AI applications inside a typical organization are still invisible to the team meant to secure them. Watch Now →<https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my1/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Three Weeks Out [AIdentity and Non-Human Identity Impact Day: Digital Trust Beyond Humans]<https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my4/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> AIdentity & Non-Human Identity Impact Day Machine, workload and AI agent identities at scale: a discussion on governing delegation as autonomous agents take on more of the work, based on themes from this month's agent-delegation webinar. Register Now →<https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my4/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Webinar Briefings September 22 [The New Workforce Identity Challenge webinar] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my7/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> The New Workforce Identity Challenge: AI Agents, NHIs, and the IAM Gap A direct continuation of this edition’s core question, for teams ready to move from “we found the agents” to “we can govern them.” Register Now →<https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2my7/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> September 29 [Road to Impact Day webinar: Who Gave the Agent Permission?] <https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2myb/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Who Gave the Agent Permission? Jonathan Care, Grace Rachmany from the Decentralized Identity Foundation, and Angelika Steinacker on scoped, revocable mandates for AI agents, and building an evidence trail that connects an agent’s actions back to whoever authorized them. Register Now →<https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2myb/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> KuppingerCole Analysts Membership Every piece of research in this edition, and a complimentary ticket to AIdentity & NHI Impact Day, come with Expert Membership. Explore KuppingerCole Membership →<https://go.kuppingercole.com/e/898881/-utm-campaign-2026-Kc-Insights/h2myf/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Copyright © 2026, All rights reserved. KuppingerCole Analysts AG | Wilhelmstr. 20-22<https://www.google.com/maps/search/Wilhelmstr.+20-22?entry=gmail&source=g> | 65185 Wiesbaden | Germany<https://go.kuppingercole.com/e/898881/l-898881-2025-08-19-g81cc/h2mym/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Amtsgericht Wiesbaden HRB 29536 Board of Management (Vorstand): Berthold Kerl (CEO), Bettina Buthmann, Oliver Schnürle Supervisory Board (Aufsichtsrat): Michel Roux (Chairman), Prof. Dr.-Ing. Ralph Bruder, Eve Maler Imprint<https://go.kuppingercole.com/e/898881/imprint/h2myq/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> | Privacy Policy<https://go.kuppingercole.com/e/898881/privacy/h2myt/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> www.kuppingercole.com<https://go.kuppingercole.com/e/898881/2026-09-16/h2myx/816323196/h/UYPrFKVva_99vrjJIoAxApWiE2QZ54M0qYak87T71Oo> Unsubscribe<https://go.kuppingercole.com/Email-Preference-Center?ehash=39c2ce481d099d5cb4deb2ba7ee789292c679b28ca0a8513672ef9e87b074f38&email_id=816323196&epc_hash=QU1MTPUalteDOKkwdvJCyDi-c4L16Ps3aHSlS5s-95c> [https://go.kuppingercole.com/r/898881/1/816323196/open/1]
participants (2)
-
Andrew Hughes -
Olsen, Chris D.