Picture this ticket landing at 4:45 on a Friday. An API key nobody recognizes would show up in a production config. It wouldn’t be from the cloud provider or any vendor in the asset register. After an hour of digging, someone might work out that it belongs to a little AI transcription service a project lead signed up for with a corporate card three months earlier, one that had been wired into a workflow and quietly fed meeting notes ever since. That’s a hypothetical, but it captures the niche AI tools cybersecurity risk infrastructure operators keep underestimating. The problem isn’t the big-name chatbot everyone argued about in the policy meeting. It’s the five hundred little ones nobody argued about at all.
I wanted actual numbers before writing this, not vibes. Three 2026 reports line up uncomfortably well.
The Long Tail: Why Niche AI Tools Are a Cybersecurity Risk for Infrastructure Operators
The most useful of the three is the 2026 AI Agent Risk & Action Report from Nightfall AI, released this spring. It’s built on anonymized, aggregated data from Nightfall’s own customers, so the numbers are a vendor’s telemetry, not a random sample. But the numbers are hard to ignore:
- More than 35,000 distinct applications discovered across its customer base, including 519 GenAI tools and 103 AI agent tools.
- The median organization runs 182 applications and 11 AI tools. The largest runs over 8,000 applications with more than 170 AI tools.
- 81% of GenAI tool adoption happens outside the top three providers, OpenAI, Anthropic and Google.
- 98% of organizations use GenAI, and 49% are using or experimenting with AI agents.
The report’s own description of the long tail could be the subtitle of this post: “For every OpenAI or Anthropic deployment that security teams are aware of, there are dozens of niche AI tools — translation, content generation, code assistance, design, research — operating with limited visibility.” Most of those tools are used by only a handful of organizations, which, as the report puts it, makes them “harder to detect, evaluate, and govern.”
Its recommendation is one I’d frame and hang in the NOC: “Assume your inventory is incomplete. The long tail moves too fast for manual tracking.”
Shadow AI Isn’t Going Away
For years, the plan at most shops was to buy an approved AI platform, move everyone onto it, and watch shadow usage dry up. The Netskope AI Report: 2026, based on aggregate data from a subset of Netskope customers from June 2025 to July 2026, says that plan has stalled.
According to Netskope, the shift from personal AI apps to organization-managed ones “stopped around March 2026, plateaued, and has trended back slightly in the opposite direction.” Its current breakdown of AI users:
- 56% use only organization-managed AI apps.
- 14% use both managed and personal apps.
- 30% use only personal apps.
Netskope’s read is that “shadow AI is here to stay.” It adds that discovery priorities have expanded to include AI agents, MCP servers and local AI infrastructure. It also reports that remote MCP users rose 250% and transactions 375% over a recent 10-week span, and that 41% of organizations are running Ollama to host models locally.
That last pair is the part infrastructure folks should circle. A personal chatbot tab is a data-loss problem. A locally hosted model or an MCP connector tied into internal systems is an asset, running on your hardware or reaching into your data, that may never have gone through change management.
The Humans Behind the Long Tail
Telemetry tells you what’s running. Surveys tell you why. The PagerDuty Shadow AI Survey, published June 11 and conducted by Wakefield Research among 1,250 office professionals outside IT and technology roles at companies with at least $500 million in annual revenue across the US, UK, Australia and Japan, found:
- 66% have used AI tools at work even though they believed doing so wasn’t permitted under company policy.
- 88% have shared work-related information with public AI tools, including 34% who have input customer data.
- 89% of those who’ve used AI for work first encountered the tool in their personal lives.
- 72% believe they know AI better than their own tech teams.
That last number stings, but it explains the pattern. People find a clever niche tool at home, decide it’s better than what IT approved, and bring it to work. No ticket gets filed, because in their minds there’s nothing to ask about.
Why This Is the New Shadow IT, and Why It’s Worse
This is my opinion, not a finding from any of these reports, but I’ve seen this movie. Shadow IT used to mean a rogue Dropbox account or a marketing team’s unapproved project tracker. You found it through expense reports, DNS logs or a firewall rule someone requested in a panic.
The AI version is harder to see for three reasons the data supports:
- The tail is enormous and constantly churning. Some 519 GenAI tools in one vendor’s dataset, with most of the usage outside the big three. No approval board reviews that many products a year.
- A lot of the AI isn’t a separate app. Nightfall calls it “Invisible AI”: features inside tools you already approved, like Google Workspace Gemini, which it found in 73% of organizations. Your inventory says “Google Workspace,” not “a model reading our docs.”
- The tools connect to things. MCP servers and agents don’t just receive pasted text. They reach into CRMs, repos and databases. Nightfall’s line is that AI risk “isn’t about the tools — it’s about what they can reach.”
What I’d Do Monday Morning
- Start with egress, not policy. Proxy, DNS and CASB logs will show AI domains no matter what the acceptable-use policy says. Sort by volume and look at what’s below the big three.
- Hunt for keys. Scan repos, CI variables and config stores for API keys to AI services you don’t have contracts with. That’s where the opening hypothetical turns real.
- Inventory the embedded AI too. Review the AI features in your major SaaS platforms and decide which ones should be on.
- Treat MCP servers and local model hosts like servers. They get owners, patching and network rules, just like anything else on the network.
- Give people a fast yes. If 66% of people use tools they think are banned, a slow approval process just pushes the problem underground.
You can’t secure what you haven’t found, and with AI tools the finding is the hard part. The good news is that the clues are already in logs we collect. Someone just has to go read them before the Friday ticket shows up.