As agentic AI tools become easier to use and more embedded in everyday application workflows, the number of sessions where something other than the employee is taking the actions will keep climbing. If your enterprise has enabled specific AI tools across your IAM stack, you might be able to see what that agent does. But if you struggle to have visibility into shadow AI and shadow AI agents, that challenge will only grow.
Shadow AI, OAuth, and the browser: Lessons from the Vercel breach
According to an industry survey, nearly half of security leaders — 48% — admitted that they had limited visibility into AI usage. In fact, it was their second biggest challenge in securing AI systems
The challenge of identity security is underscored by startling statistics. Despite decades of security awareness training, 60% of breaches involve a human element, with stolen or misused credentials driving 22% of initial access attempts. This week, we announced our partnership with SpyCloud to address this concern.
Dashboards record what happened — they don't stop it. In high-velocity AI workflows, detection after submission is too late. Observation isn't control.
Authentication happens once. AI-driven work unfolds all day. Point-in-time controls can't govern continuous exposure inside live browser sessions.
SSO and MFA confirm who you are — not what you do. The gap between authentication and in-session behavior is where modern breaches now live.
Breaches rarely cause damage at the perimeter. They succeed inside trusted sessions, under valid identities, after login.
Work moved to the browser. Risk followed. Controls didn't. Why the session layer is the most critical — and least defended — part of your attack surface.
2025 was a pivotal year in cybersecurity, marked by the rapid, often chaotic, integration of AI into both modern enterprise workflows and the threat landscape. As we look ahead to 2026, the convergence of expanding workforces, unchecked Shadow AI adoption, and highly sophisticated identity-based attacks suggests that established security models are no longer sufficient.
Elevating Security: How Our Partnership with Elastic Boosts Visibility and Threat Detection for Modern Workforces
In 2024, infostealer malware quietly fueled some of the most devastating breaches in cybersecurity—including attacks on Snowflake and MGM Resorts—rendering multimillion-dollar identity investments nearly useless within minutes. Over 4.3 million devices were infected, and 2.1 billion credentials were stolen, giving threat actors budget-friendly dark web access to critical corporate environments and bypassing even MFA protections.
.png)
