CYBERSECURITY | Shadow AI widens identity security gaps in APAC
The findings highlight a security challenge as employees connect AI assistants and automated agents to corporate applications, cloud repositories and customer relationship management systems.
A lack of visibility into unauthorized artificial intelligence tools is creating identity governance risks for businesses across Asia-Pacific, with 53% of regional cybersecurity leaders identifying AI-related non-human identity management as a major gap, according to a Keeper Security study.
The findings highlight a security challenge as employees connect AI assistants and automated agents to corporate applications, cloud repositories and customer relationship management systems without formal approval or adequate oversight.
Unlike conventional unauthorized software, shadow AI can involve persistent credentials, application programming interface (API) keys and permissions that allow automated systems to access sensitive enterprise data. These machine identities can remain active without clear ownership or regular monitoring.
IBM’s 2026 Cost of a Data Breach Report, as cited in Keeper Security’s commentary, found that 43% of breached organizations had experienced an incident involving shadow AI, up from 20% a year earlier. Breaches involving shadow AI cost an average of $5.39 million, according to the report.
Takanori Nishiyama, Keeper Security’s senior vice president for Asia-Pacific and Japan country manager, said the risk extends beyond information exposure to the growing number of machine identities that organizations cannot adequately track or govern.
AI integrations create new security risks
AI tools can be connected to workplace applications with minimal setup, allowing employees to automate tasks and process information quickly. However, integrations may create service accounts, tokens and other credentials that fall outside established identity management processes.
These credentials can remain active after an employee leaves an organization or stops using a particular tool. Without clear ownership, access reviews and automated credential rotation, they can become persistent entry points into corporate systems.
An AI agent with access to a production database can carry risks comparable to those posed by a human administrator with equivalent permissions, Nishiyama said. Automated systems can also execute actions at machine speed, increasing the potential consequences of excessive access.
Keeper Security’s Identity Security at Machine Speed report surveyed 3,200 cybersecurity decision-makers and senior IT leaders, including 500 respondents in Asia-Pacific across Australia, India, New Zealand and China.
In addition to the 53% who identified AI-related non-human identity management as a major governance gap, 47% of APAC respondents cited limited visibility into employees’ AI tools as a significant concern. Only 38% said their organizations had fully deployed a privileged access management (PAM) solution.
The report placed the regional figure for AI-related non-human identity management 10 percentage points above the global average of 43%.
APAC governments develop AI governance guidance
Governments and regulators across Asia-Pacific are developing guidance for managing AI systems, including autonomous agents that interact with enterprise applications and data.
Japan’s Ministry of Economy, Trade and Industry and Ministry of Internal Affairs and Communications published version 1.2 of the AI Guidelines for Business on March 31, 2026. The update introduced a definition of AI agents.
Singapore’s Infocomm Media Development Authority launched its Model AI Governance Framework for Agentic AI in January 2026. The framework calls for traceable agent identities linked to accountable humans and recommends limiting agents’ access to the tools and data required for their tasks.
The Cyber Security Agency of Singapore followed in June 2026 with its finalized addendum on securing agentic AI.
In Australia, the National AI Centre’s Guidance for AI Adoption addresses accountability and human control, while the Office of the Australian Information Commissioner advises organizations against entering personal information into publicly available generative AI tools.
These frameworks and recommendations differ in scope and legal status. Organizations must assess the requirements applicable to their operations rather than treating all guidance as binding regulation.
Identity-first controls for AI systems
Nishiyama argued that banning unauthorized AI tools outright may not eliminate shadow AI because employees could turn to less visible alternatives. Instead, organizations need to extend identity security controls to both human users and machine identities.
The first step is to discover sanctioned and unsanctioned AI tools, agents and integrations, including the non-human identities and credentials they create. Security teams should also monitor privileged sessions and maintain records of AI-driven activity to support investigation and auditing.
AI agents and service accounts should be subject to defined ownership, authentication, authorization and lifecycle management requirements. These controls include least-privilege access, automated credential rotation and timely deprovisioning when an account or workload is no longer needed.
Organizations can also reduce exposure through zero standing privilege, granting elevated access only when an AI agent needs it for a specific task and revoking it afterward.
Zero-trust controls require each access request to be verified and limit permissions to what the requested task requires, regardless of whether the request originates from a person or an automated system.
As businesses integrate AI into daily operations, the challenge is to make every tool, credential and machine identity visible and accountable. Without that oversight, expanding AI adoption can increase the number of access paths that security teams cannot effectively manage.
Full disclosure: All news articles published on the TechSabado website are written by human journalists, unless otherwise specified. Final text editing is also performed by human editors, with artificial intelligence (AI) used only to assist with additional grammar and style guide corrections..
————————————————————————-
TEN YEARS OF TECHSABADO!
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE & SPOTIFY channels.
WATCH TECHSABADO ON OUR YOUTUBE CHANNEL:
WE ARE ALSO ON SPOTIFY
WATCH OUR OTHER YOUTUBE CHANNELS:
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE CHANNEL.
