Shadow AI, OAuth sprawl, and why your next insurance renewal is going to ask about both
Somewhere in your company, about fourteen months ago, an employee found an AI meeting assistant that looked genuinely useful. They signed in with their work account. A Microsoft consent screen appeared and asked for a few things: read your mail, read and write files across site collections, maintain access to data you’ve given it access to. They clicked Accept. The whole interaction took eleven seconds.
That employee doesn’t work here anymore, but the permission does.
This is the security story of today for small and mid-sized businesses, and it isn’t a new strain of ransomware. It’s a slow accumulation of standing access that nobody inventoried, granted to tools nobody approved, held by identities that aren’t people — arriving at the exact moment cyber insurance carriers decided to start asking about it in writing. And this is not shadow IT with a new coat of paint
Shadow IT was an unapproved app someone used. Annoying, occasionally dangerous, but bounded — the risk lived inside that one tool.
Shadow AI works differently, and the difference is the part worth understanding. When an employee connects an AI tool to Microsoft 365 or Google Workspace via OAuth, they aren’t just using software. They’re issuing a credential. And OAuth tokens behave in ways that break the mental model most business owners have about access:
- A token is a bearer credential. Whoever holds it is treated as authorized. It doesn’t need the password.
- It doesn’t re-prompt for MFA. Your multi-factor investment protects the login. The token already passed the login.
- It survives password resets. Changing credentials after a scare does not revoke a live grant.
- It outlives the employee. Disabling a user account and revoking sign-in sessions is not the same operation as revoking the app permissions that user granted.
That last one deserves a second read, because most offboarding checklists in small businesses end at the human. The token doesn’t know the human left.
And these grants accumulate quietly. Nobody gets a notification that says “your company now has 47 standing third-party integrations into your file storage.”
The blast radius won’t just be yours
The 2025 Salesloft Drift compromise is the case study, and it’s worth walking through because it shows the mechanism cleanly.
- Attackers worked their way into the vendor’s own environment and stole active OAuth and refresh tokens — the ones customers had granted so the chatbot could talk to their Salesforce and Slack instances. Armed with legitimate, already-approved tokens, the attackers logged into those customer systems as the trusted integration.
- Nobody’s password was guessed. Nobody’s MFA was phished. No malware landed on an endpoint. The front door had been propped open months earlier by a routine consent click, and the attackers simply walked through the vendor.
This is what makes AI integration risk structurally different: your security posture now includes your vendors’ security posture, inherited automatically, without a third-party review anyone ran.
The scale is not niche. Grip Security’s analysis of roughly 23,000 SaaS environments found embedded AI in every single one, alongside a sharp year-over-year spike in public SaaS
Why your 40-person company is in scope
Two findings frame the problem better than any threat statistic:
- Gartner projects that by 2026, about 70% of employee AI interactions will happen through features built into SaaS you already approved. Read that carefully. It means the tool is no longer the risk surface. Your team doesn’t need to go download something suspicious — the AI arrived in the software you already pay for, and the meaningful question is what data it can reach.
- IBM’s research found that 97% of organizations reporting an AI-related breach lacked proper access controls. Not a novel exploit. Not a zero-day. Permissions.
Supporting numbers fill in the picture: shadow AI has been measured adding roughly $670,000 to the cost of a breach, roughly 80% of employees report using AI tools that were never approved, and only about 37% of organizations have any governance policy covering it.
If you have never pulled a list of the third-party apps connected to your tenant, you do not have 37%’s problem. You have the other one.
The part that turns this from a security topic into a budget topic
Here’s what changed in the last twelve months, and why this belongs on an owner’s desk rather than a technician’s queue.
Cyber insurance questionnaires have roughly doubled in length — from around 40 questions in 2022 to 70 or more, with some carriers now running 12-to-20-page applications. The length isn’t really the story. The change in *kind* is. A 2022 form asked whether you had endpoint protection. A 2026 form asks which product, deployed on what percentage of assets, monitored by whom, for how many hours a day.
Carriers added OAuth application governance and privileged access questions in 2025. AI data governance sections are now appearing across the market: what AI tools are approved, what data classification applies to each, who owns the policy, what happens when someone discloses something they shouldn’t have.
The renewal questionnaire has effectively become a compressed security audit — and the answers are attestations.
That’s the exposure most owners haven’t priced. Policies are being voided after claims because applicants answered optimistically. The classic example is the MFA question: it asks about email, remote access, *and* admin accounts. A business with MFA on email but not on VPN answered “yes,” and found out during forensics — after an incident — what the word “and” meant.
You can be paying premiums on a policy that will not pay out, and never know until the worst week of your business’s life. The AI governance questions are going to generate the next wave of exactly this, because “we don’t really use AI here” is an answer a five-minute audit of your tenant will contradict.
What to actually do in the next 30 days
Concrete, in order, and mostly free.
- Pull the list. In Microsoft 365, that’s the Entra admin center under Enterprise Applications, filtered to third-party apps. In Google Workspace, it’s Admin console → Security → API controls → App access control. Do this before you decide how big your problem is. Most small businesses find several times more connected applications than they’d have guessed.
- Sort by permission scope, not by app name. An app with read access to one shared calendar is not the same animal as one holding `Files.ReadWrite.All` across the tenant. Watch specifically for `offline_access` — that’s the scope that grants persistence, the refresh token that keeps working after everyone’s gone home.
- Stop blanket user consent. Restrict user consent to verified publishers and low-impact permissions, or disable it entirely and route requests through an admin consent workflow. This is a settings change, not a purchase. It’s also the single highest-leverage item on this list.
- Add token revocation to offboarding. Write it into the checklist explicitly, next to the badge and the laptop. Revoking sessions ≠ revoking grants.
- Write the one-page AI policy.** Approved tools, what category of data may go into each, who approves a new one, and what an employee does after an accidental disclosure. It does not need to be sophisticated. Underwriters are largely checking whether someone thought about this systematically and wrote it down, and whether that person is named.
- Do this 30–60 days before your renewal, not during. Fixing a gap and documenting the fix reads very differently to an underwriter than discovering it while the form is open on your screen.
One honest caveat
Locking down consent will generate help desk tickets, and it’s worth being clear-eyed about why.
The people who connected those AI tools were, in the overwhelming majority of cases, not being reckless. They were solving a real problem faster than the approved toolset allowed. If you close that door without opening a sanctioned one behind it, the behavior doesn’t stop — it migrates to personal accounts on personal devices, where you have no visibility, no logging, and no ability to revoke anything at all.
Governance that is only prohibition fails on contact with the first real deadline. The version that works pairs the restriction with a short list of approved tools people can actually use, and a path to get new ones added that takes days rather than quarters.
ONE thing to do, if you do nothing else
Open your admin console this week and look at the list of applications with standing access to your company’s email and files. This is a ten-minute task.
If everything on it is something you recognize and approved, you’re in better shape than most. If it isn’t, you’ve just found the gap between the security posture you believe you have and the one you’ll be attesting to on your next renewal — while there’s still time to close it.
CMIT Solutions of Rochester helps small and mid-sized businesses inventory and govern third-party and AI application access, harden Microsoft 365 and Google Workspace configurations, and prepare defensible documentation ahead of cyber insurance renewals. If you’d like a review of what’s currently connected to your environment, we’re standing by to help. Contact us!
