Publication Date
11-3-2026
Abstract
The rapid integration of artificial intelligence into enterprise software has introduced a critical governance challenge: Shadow AI, the unmanaged and often invisible adoption of AI tools and features by employees outside formal IT oversight. Unlike traditional Shadow IT, which centers on unauthorized data storage and infrastructure, Shadow AI operates at the knowledge and decision-making layer, introducing probabilistic risks including data leakage, agentic misalignment, and indirect prompt injection that existing security frameworks are ill-equipped to address. This paper presents a Systematic Literature Review (SLR) synthesizing 38 peer-reviewed and industry sources to investigate three research questions: how organizational visibility gaps into embedded and employee-used AI increase cybersecurity and data privacy risk; what cybersecurity incident types are most commonly associated with ungoverned AI-enabled applications; and what risks employee interactions with AI pose to sensitive, proprietary, and regulated data. The analysis identifies a critical visibility deficit created by AI capabilities embedded within vendor-managed platforms, the semantic opacity of large language model interactions, and employees' utilitarian bypass of security policies. A taxonomy of six AI-specific incident types is presented, encompassing data leakage, prompt injection, credential compromise, agentic misuse, phishing augmentation, and insecure plugin exploitation. Findings demonstrate that existing governance mechanisms, including data loss prevention systems, identity and access management frameworks, and static risk assessments, are structurally misaligned with the dynamic nature of generative AI. The paper recommends a transition to dynamic, risk-based governance integrating continuous monitoring, cross-functional oversight, and AI TRiSM frameworks.
Included in
Information Security Commons, Management Information Systems Commons, Technology and Innovation Commons