On the migrations I’ve been brought in on, the apps that cause trouble are usually installed on a few machines that nobody put in the inventory. They don’t show up in discovery. They surface when something changes around them.
It happens all the time: the timeline slips, packaging and testing get redone, and now and again something live goes down.
I was at ServiceNow World Forum in London earlier this week and shadow AI came up in the keynote and again in more than one session. On 15 October ServiceNow announced AI Passport, a signed credential each agent checks at runtime to confirm what it is authorised to do, alongside shadow AI detection to find unapproved agents running on a network. The keynote’s three questions put a familiar migration problem into an AI context:
Those are the questions I’ve been asking on migrations for years, and shadow IT is still prevalent as ever. However there is a new more dangerous kind now with shadow AI. It is worse than shadow IT because it wields all the permissions of the person using it while blind to the context, and so it can do something terrible without knowing it is terrible. A person’s ignorance has always limited the harm they could do, but an AI has no such limit.
Shadow IT drained IT: teams supported apps that shouldn’t exist, running on data and services nobody had budgeted for. With shadow AI your data, your business security and anything the AI can do at machine speed is at risk. I’m seeing how much access some people are giving to LLMs on their machines, and when you give it all that access in an untamed environment who knows what it could do. In July 2025 a sanctioned Replit agent deleted a live database of 1,206 executives during a code freeze, then wrongly said it couldn’t be recovered. If a sanctioned tool did that, nobody can say how many incidents like it are happening with shadow AI.
Before any third-party agent touches an application I’m migrating, I’d want two things checked. The first is intent scope, which is what the agent is meant to be doing. The second is just-in-time privilege, which means it only gets access at the moment it needs it, and only for as long as it needs it.
AI Passport is due in Q4. I really like it because it scopes what an agent can do and what it can reach. It also covers third-party agents and MCP servers.
I wrote about the identity side of this in May, for agents a company sets up itself.
A passport only gets checked by an agent somebody registered, though, and shadow AI is the ones nobody set up. Detection covers network traffic, so it will miss an unregistered app running on a single laptop. That is the kind of app that has cost me time on migrations, and a lot of shadow IT is exactly that, individual machines or SaaS.
ServiceNow’s discovery runs on Armis, a security company that finds and monitors connected devices. I want to look into how Armis does discovery, and whether it would have caught the apps that turned up after my cutovers.
One of the security sessions made a point worth repeating. When a process is run slightly differently in another part of the organisation, it changes the data that comes out of it and the decisions that get made, which can break downstream automation. Shadow AI multiplies those variations. If teams across a business use different tools, there is no single known process to measure, so it is harder to improve any of them.
So I’d start by answering what you know, what it can access and what it should be permitted to do, before looking at any tooling. One security speaker did exactly that, mapping their existing controls against the OWASP Top 10 for LLM Applications instead of buying new products.