The first wave of enterprise AI concern was straightforward. It was simply employees pasting sensitive data into public AI tools. Security teams responded with usage policies, domain blocks, and data loss prevention rules. That response made sense at the time.

It doesn't fit the problem anymore.

Shadow AI has shifted from a data leakage concern to an access control problem. The threat isn't