Who Authorised That? Shadow AI in the Age of Autonomous Agents - A webinar by KuppingerColexINCYBER

Who Authorised That? Shadow AI in the Age of Autonomous Agents - A webinar by KuppingerColexINCYBER

by INCYBER · View the channel on PSI

Humanities, Social Sciences & Thought AI & Society UBDigital and Information technology: general topicsUBJDigital and information technologies: social and ethical aspects
🎙 INCYBER 👥 7K 📅 October 19, 2026 ⏱ 56 min 👁 38 📄 expert opinion 🧭 2026-10-20
Available in: English (current) Français

Keywords

shadow AIautonomous agentsidentity access managementAI governanceMCP

Summary

This webinar, hosted by Forum INCYBER in collaboration with KuppingerCole, addresses the evolving challenge of Shadow AI in enterprises. The speakers define Shadow AI as the use of unauthorized AI tools and agents, moving beyond simple copy-paste to autonomous agents acting with delegated credentials. Jonathan Care from KuppingerCole outlines four stages of shadow IT, from data leakage via personal accounts to sanctioned tools becoming blind spots, and the impact of regulatory frameworks like the EU AI Act and DORA. Tanguy Duthion from Avanoo explains how his company’s browser extensions and agents detect AI usage through metadata, login patterns, and MCP connections. He emphasizes the importance of discovering all AI tools, as customers often find over 200 versus the seven known. Avenu’s solutions include a discovery tool, MCP proxy, and AI DLP to anonymize sensitive data. Alessandro Gai, CISO of Efficy, shares his organization’s experience, initially discovering unapproved tools and later discovering AI features embedded within existing software. He highlights the challenge of approving MCP servers without full visibility into their usage. The webinar concludes that gaining visibility and implementing in-context governance is key to managing Shadow AI without hindering innovation.

190 words

Critical Evaluation

Value of the Information & Strength of the Argument

The webinar provides valuable practical insights into the detection and management of Shadow AI, offering real-world statistics from Avanoo’s customer base and a detailed case study from Efficy. The argumentation is built on expert opinions and experience, with logical progression from identifying the problem to proposing methodology. However, the lack of independent data and the presence of vendor pitches weaken the scientific rigor. The speakers make compelling points about the inadequacy of traditional IAM tools and the need for specialized discovery mechanisms, but the evidence is anecdotal rather than empirically validated.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate. The primary sources are regulatory frameworks such as the EU AI Act, DORA, and NIST2, which are mentioned but not deeply analyzed. No specific studies or research papers are cited. The title-content match is strong, but the webinar is partly promotional for Avanoo, which may introduce bias. The speakers are credible, but the lack of independent verification and the presence of vendor demonstrations reduce overall reliability. The Q&A section, though not fully shown, suggests some engagement with audience questions.

190 words

Title / Content Match

The title accurately reflects the content, which focuses on shadow AI in the context of autonomous agents and questions of authorization.

Quality & Reliability

7/10

Speakers are experienced professionals with credible backgrounds, but the webinar is partially promotional for Avanoo's solutions, and no independent verification of claims is provided.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • EU AI Act — Regulatory framework for AI mentioned as a compliance requirement.
  • DORA (Digital Operational Resilience Act) — Regulation for financial sector resilience mentioned in context of shadow AI governance.
  • NIST Cybersecurity Framework 2.0 — Reference for cybersecurity best practices mentioned by Jonathan Care.
  • ISO 27001 — Information security management standard referenced in the video description.

Contribution & Novelties

The webinar offers a contemporary perspective on shadow AI, emphasizing the transition from simple user interactions to autonomous agents and the subsequent blind spots in traditional identity and access management. It introduces practical detection methods, including browser metadata analysis and MCP connection monitoring, which are rarely covered in existing literature. The case study from Efficy provides concrete insights into real-world discovery processes.

Pour aller plus loin :

  • Shadow IT — Provides background on the broader concept of unauthorized technology use.
  • EU AI Act — Regulatory context for AI governance and compliance.
  • Model Context Protocol — Technical foundation for AI agent connectivity, relevant to MCP discussions.

105 words

Radar Profile

The radar profile shows a balanced score, with quantity and technical level slightly higher than quality and reliability, indicating that the content is rich and technical but may lack rigorous scientific backing or independence.

Reliability 7/10