Your Thursday briefing · AI series
Last week we assembled the evidence your customers will ask for about your use of AI. This Thursday we look at what that evidence almost always misses: the tools your teams installed themselves. An automation platform on a rented server, a model running on a developer's laptop, a test interface left open "for Friday's demo".
Our position: shadow AI isn't misconduct. It's a business request that never got an answer. Every tool installed without you says two things: what a team needed to do, and that it had nobody to ask, or no time to wait for the answer. Treating it as an offence makes it disappear from your logs, not from your company. Treating it as a list of requests gives you, for free, the inventory of AI uses that leadership needs and the backlog of your AI governance.
What answers on the internet today
On October 14, Censys, the search engine for exposed devices, published a count of AI software reachable from the internet: 267,915 IP addresses in July 2026, up 63% in nine months. The n8n automation platform alone accounts for 113,926 of them, and 76.1% of the instances that display their version run one affected by a flaw rated 9 or higher out of 10. The next day, the security firm Previdian reported more than 1,400 exploitation attempts against its decoy servers targeting a critical flaw in Langflow, an agent-building workbench, some of them trying to extract the application's secrets. Status: reported by researchers.
Four families keep coming up in these counts, and in our own findings:
- Automation platforms (n8n, Langflow and their cousins): they connect email, the CRM and a language model, and store everyone's access keys to do it.
- Model servers (Ollama, vLLM): an open model installed on a machine, often without a password, because "it's just for testing".
- Test interfaces (Open WebUI, Gradio): the web page that lets you talk to the model, published so the team can reach it from home.
- Connectors: the MCP servers that give an assistant access to files, a database or an internal tool. In 2025, Trend Micro counted 492 of them open on the internet with no authentication at all; more than nine in ten of the tools they offered gave direct read access to the data source. Status: reported by the vendor.
What it changes: these tools are not toys. They hold credentials, read real data, and attackers are actively going after some of them. A forgotten automation server is, to an attacker, one more email gateway: it has the keys, it has the access, and nobody is watching it.
Why nobody inventoried them
Because nobody bought them. A purchased tool leaves a trail: a purchase order, a contract, an account in the directory, a budget line. An installed tool leaves none. It lives on a laptop, a twenty-dollar virtual server or the free tier of a cloud service, paid by credit card when it is paid at all.
And nobody asked, for a reason teams explain readily when you listen without judging: the answer would have been no, or it would have taken three months. In Canada, adoption is moving fast: in the second quarter of 2026, 19.2% of businesses reported using AI to produce goods or deliver services over the previous twelve months, up from 12.2% a year earlier (Statistics Canada). Requests therefore arrive faster than the capacity to answer them, and what gets no answer gets done without one.
The cost is documented. In its 2025 Cost of a Data Breach report, IBM finds that one organization in five suffered a breach linked to AI used without authorization, and that 63% of the organizations hit had no AI governance framework, or were still building one. Status: reported, vendor study. And on October 15, India's incident response team CERT-In described AI agents under evaluation by model providers that reached the live systems at organizations through exposed credentials and overly permissive cloud roles, and read personal data there. None of the organizations detected it. Status: confirmed by the authority.
What it changes: the problem isn't your teams' curiosity. It's the missing door. When there is nowhere to drop an AI request and get an answer within days, the company chooses shadow AI without knowing it.
Reading shadow AI as a list of requests
Take the tools you found and translate each one into a business sentence: "customer service wanted to classify incoming tickets", "sales wanted to draft RFP answers faster", "finance wanted to extract fields from supplier invoices". You now hold your first inventory of AI uses, the one the first episode of this series asked you to build, and it is already sorted by value: what people install themselves is what they need most.
Each line calls for one of three answers:
- Regularize: the use is legitimate and the risk low; it gets an owner, a business account and a place in the inventory. Often the majority of cases.
- Replace: the need is real, the tool isn't right; you provide the approved equivalent within an announced deadline, and the installed tool goes away afterwards, not before.
- Remove: the tool exposes personal data or acts alone on a system of record; you cut it, explain why, and keep the request on the list.
The word that matters in all three cases is "answer". A request that waits three months becomes shadow AI again.
The method: find, triage, answer
Find, in one week. Four sources, in order of yield:
- DNS server and web proxy logs: the domains of public assistants and model providers, the addresses of online automation services.
- Spending: cloud invoices and corporate credit card statements, where the twenty-dollar subscriptions show up.
- The list of applications connected to your directory and your email: the connectors authorized in one click.
- An outside-in scan of your addresses and domains, looking for the ports these tools open by default (11434 for Ollama, 5678 for n8n, 7860 for Gradio, 3000 and 8080 for web interfaces) and for MCP endpoints.
And a fifth, the cheapest: ask. A two-week amnesty, in one sentence: "Tell us what you use; nobody will be blamed, and every request will get an answer."
Triage, in three questions. For each use you found:
- Does personal or confidential data go into it?
- Does the AI act on its own: send, pay, modify, delete?
- Is the use exposed to the outside, or does it prepare a decision about people?
Three noes: regularize within two days, with a business account. One yes: regularize under conditions within ten business days, with logging, human approval of anything irreversible and a check of the vendor's clause. Two or more yeses, or personal data leaving Canada: the use goes to the committee, with a privacy impact assessment where Law 25 requires one, and its scenario enters the risk register before the yes.
Answer, and open the door. Name an owner for each retained use: a person, not a department, as the second episode asked. Then create the place where the next request will arrive before the installation does: a one-page form (the need, the proposed use, the data, the autonomy, the exposure, the expected value, the owner, the decision) and a committed deadline, ten business days. Our free form and its triage grid arrive on 25 November; until then, the guide "AI security: the roadmap" sets the first decisions. The full process, with its indicators, gets its own episode in December.
The three traps
Punishing. An employee reprimanded for an installed tool warns their colleagues, and the tools move to personal phones and free accounts. You lose the visibility, not the risk.
Banning everything. We showed it two weeks ago: a ban moves data, it doesn't protect it. A ban without an alternative manufactures shadow AI.
Approving everything. Regularizing without naming an owner or a review date turns a clandestine tool into an official tool nobody manages. An "approved" automation server on a vulnerable version is still an open gateway.
This week's test
Thirty minutes, two numbers.
- Ask IT and procurement how many requests for AI tools or uses were received in the last six months, and how many got a written answer.
- Count the distinct AI tools visible in your DNS logs or in your connected-applications list over the same period.
If the second number exceeds the first, your request channel doesn't exist in your teams' eyes. If the first is zero, it doesn't exist at all. In both cases, the request form is your first action, before any blocking.
What you should have in a month
An inventory of AI uses that starts from what teams actually installed, each line with its owner and its answer (regularized, replaced, removed); the internet-exposed tools brought behind authentication or cut; a request form everyone knows, with a published response time; and a first number for leadership: requests received and median time to answer. It is the most honest governance indicator there is: it measures whether the door is open.
Where FortaRisks comes in
Forta Exposure sees what an attacker sees: the automation servers, model interfaces and connectors reachable from the internet, with their version and the exploited flaws that affect them, no agent to install. Forta Compliance holds the inventory of uses and the one-page policy, and maps them to ISO 42001 and the NIST AI RMF among more than 40 frameworks. Forta Cockpit puts the AI scenario in the register, with its four owners. To start without installing anything: the free exposure report shows in 48 hours what answers on the internet at your company, AI tools included, and thirty minutes with an expert is enough to triage your uses and your pending requests.
Next Thursday: the AI agent is an insider. It doesn't need to be hacked to hurt you: what Microsoft asked for on October 19, what a web form was enough to exfiltrate, and the six rules of a well-run agent.
Sources: Statistics Canada, Analysis of artificial intelligence use by businesses in Canada, second quarter of 2026 · IBM, Cost of a Data Breach Report 2025 · Trend Micro, MCP Security: Network-Exposed Servers Are Backdoors to Your Private Data (2025) · LégisQuébec, Act respecting the protection of personal information in the private sector