# Netskope "Beyond Shadow AI" Report: Shadow AI Data Exposure Escalates as Agentic AI/MCP Governance Lags Enterprise Adoption

> Netskope's "Beyond Shadow AI" report (telemetry window: October 2024 - October 2025) finds organization-managed GenAI account usage rose from 25% to 62% year-over-year, yet GenAI data-policy violations doubled to roughly 223 incidents per organization per month, driven mainly by source code (42%), regulated data (32%), and intellectual property (16%) leakage. The report also flags agentic AI and the Model Context Protocol (MCP) as an under-governed emerging attack surface, with only 8% of organizations reporting any MCP governance policy.

- **Published:** 2026-07-28T00:00:00Z
- **Last reviewed:** 2026-07-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1735
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-netskope-beyond-shadow-ai-report-tl-2026-1735.webp?v=6dc986d5 (Threadlinqs threat intel: Netskope Beyond Shadow AI MCP Gap: Analysis & Hunting (TL-2026-1735) — Medium severity, 22 IOCs, 9 detection rules.)
- **ID:** TL-2026-1735
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 22

## Description

Netskope's "Beyond Shadow AI" report analyzes telemetry from its Security Cloud customer base over an October 2024-October 2025 window and finds a mixed security picture for enterprise generative-AI (GenAI) adoption. On the positive side, the share of GenAI users on company-approved, organization-managed accounts rose sharply from 25% to 62% year-over-year, while personal, unmanaged-account usage fell from 78% to 47%. A residual 9% of users (up from 4% the prior year) actively switch between personal and enterprise accounts for the same GenAI tools, undermining the value of managed-account controls by giving users an easy escape hatch from monitored channels.

Despite that account-management progress, GenAI data-policy violations doubled year-over-year, with the average organization recording approximately 223 violations per month, committed by roughly 3% of users. The three most common categories of leaked data were source code (42% of violations), regulated data such as PII/PHI/financial records (32%), and intellectual property (16%). Netskope names ChatGPT, Google Gemini, and Microsoft 365 Copilot as the GenAI tools most frequently accessed through personal, non-organizational credentials, stating: "A substantial share of employees are relying on tools such as ChatGPT, Google Gemini and Copilot, using credentials not associated with their organization." Netskope's own recommendation is that enterprises pair "clearer policies, better provisioning, and ongoing visibility into how AI tools are actually being used" rather than relying on blocking alone, since employee behavior is consistently outpacing governance policy.

The report separately identifies agentic AI and the Model Context Protocol (MCP) - the emerging standard integration layer that lets LLM-based agents call external tools, APIs, and data sources - as an escalating, largely ungoverned attack surface: only 8% of organizations report having any policy governing MCP use at all. This finding is corroborated by independent security research: Checkmarx documents concrete MCP-specific attack techniques including tool poisoning (hidden malicious logic embedded in tool descriptions/schemas), confused-deputy privilege escalation (MCP servers acting on a user's behalf without properly verifying authorization, enabling cross-user access via OAuth token reuse), supply-chain "rug pull" attacks (a previously trustworthy MCP server or dependency turning malicious via an update), tool shadowing/typosquatting, and context/resource poisoning of shared agent state. Cisco's AI Threat Intelligence and Security Research group (reported via Help Net Security, 2026-02-23) found only 29% of organizations feel prepared to secure agentic AI deployments, an 92% success rate for multi-turn prompt-injection/jailbreak attacks across eight tested open-weight models, and documented a real-world case of a fake npm package used in an MCP-adjacent supply chain to copy outbound agent messages to an attacker-controlled address; the same research noted China-linked threat actors have automated an estimated 80-90% of an attack chain using jailbroken AI coding assistants.

In response to the governance gap, Netskope has begun extending its own platform (Netskope One) with MCP-specific controls - Cloud Confidence Index risk scoring for MCP servers, a default-block option for unapproved MCP traffic, least-privilege access restriction for AI agents, DLP inspection of MCP traffic for IP/credential leakage, and detailed logging of MCP sessions, tool calls, and responses - per Chief Product Officer John Martin. At the regulatory level, CISA, the NSA, and the cyber agencies of Australia, Canada, New Zealand, and the UK jointly published "Careful Adoption of Agentic AI Services" on 2026-05-01, the first coordinated multinational guidance on agentic AI risk, defining five risk categories (privilege escalation, design/configuration failures, behavioral misalignment, structural brittleness, and accountability gaps) and calling for cryptographically anchored, short-lived credentials for every autonomous agent. The findings track closely with the OWASP Top 10 for LLM Applications categories LLM05 (Supply Chain Vulnerabilities), LLM06 (Sensitive Information Disclosure), and LLM08 (Excessive Agency).

This is a threat-landscape/governance report rather than a specific exploited vulnerability - no CVE or CVSS score applies - but it is tracked because it quantifies an active, organization-wide data-exposure risk (shadow AI usage plus an emerging, near-ungoverned agentic-AI/MCP attack surface) directly relevant to SOC risk posture, DLP tuning, and enterprise AI governance policy.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1554 Compromise Host Software Binary
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1526 Cloud Service Discovery
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1119 Automated Collection
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1102 Web Service
- T1071 Application Layer Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Shadow AI Exfiltration — Sensitive Data POSTed to Personal/Unmanaged GenAI Endpoint** (`TL-2026-1735-SPL-001`)

Detects users submitting source-code, regulated data (PII/PHI/financial), or intellectual-property-tagged content via HTTP POST to a generative-AI web destination while authenticated with a personal/unmanaged account rather than an org-managed, SSO-integrated session — the primary pattern behind Netskope's ~223 monthly GenAI DLP violations per organization (42% source code, 32% regulated data, 16% IP).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1567, T1078, T1204
- **Data sources:** netskope_casb, zscaler_proxy, web_proxy_logs, dlp_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=casb OR index=proxy sourcetype IN ("netskope:page","zscaler:web","proxy:web") dst_category="generative-ai" http_method=POST
| eval account_type=coalesce(account_type, ccl_account_type, "unknown")
| where account_type IN ("personal","unmanaged","byoai")
| eval dlp_hit=if(match(dlp_profile, "(?i)source[-_ ]?code|regulated[-_ ]?data|pii|phi|intellectual[-_ ]?property"), 1, 0)
| where dlp_hit=1
| eval app_name=coalesce(app_name, dst_host)
| stats count as violation_count, sum(bytes_out) as total_bytes_out, min(_time) as first_seen, max(_time) as last_seen, values(dlp_profile) as dlp_categories by user, src_ip, app_name
| where violation_count >= 1
| sort - violation_count
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor in ("Netskope","Zscaler","McAfee","Broadcom") and DeviceEventClassID has "generative-ai"
| where RequestMethod == "POST"
| extend AccountType = tostring(parse_json(AdditionalExtensions).account_type)
| where AccountType in ("personal","unmanaged","byoai")
| extend DlpProfile = tostring(parse_json(AdditionalExtensions).dlp_profile)
| where DlpProfile has_any ("source-code","regulated-data","pii","phi","intellectual-property")
| summarize ViolationCount=count(), TotalBytesOut=sum(toint(SentBytes)), Apps=make_set(DestinationHostName), Profiles=make_set(DlpProfile) by SourceUserName, SourceIP
| where ViolationCount >= 1
| order by ViolationCount desc
```

### Sigma

```yaml
title: Shadow AI Exfiltration - Sensitive Data POSTed to Personal GenAI Endpoint
id: 6f1e2a4a-2f1b-4b7a-9c3d-1a2b3c4d5e01
status: experimental
description: Detects sensitive-data (source code, regulated data, IP) POST requests to generative-AI web destinations from personal/unmanaged accounts, bypassing org DLP/CASB visibility.
references:
    - https://www.netskope.com/blog/beyond-shadow-ai-the-netskope-ai-report
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-28
tags:
    - attack.exfiltration
    - attack.t1567
    - attack.initial-access
    - attack.t1078
tags_note: attack.t1078.004 sub-technique refers to cloud accounts (personal/shadow GenAI credentials)
logsource:
    category: proxy
    product: casb
detection:
    selection:
        dst_category: 'generative-ai'
        account_type: 'personal|unmanaged|byoai'
        http_method: 'POST'
        content_type|contains:
            - 'text/plain'
            - 'application/json'
    dlp_hit:
        dlp_profile|contains:
            - 'source-code'
            - 'regulated-data'
            - 'pii'
            - 'phi'
            - 'intellectual-property'
    filter_managed:
        account_type: 'organization-managed'
    condition: selection and dlp_hit and not filter_managed
fields:
    - user
    - dst_host
    - bytes_out
    - dlp_profile
falsepositives:
    - Approved pilot program temporarily using personal accounts before SSO migration completes
    - DLP profile misclassification of public documentation content
level: high
```

**Known false positives:**

- Approved pilot program temporarily using personal accounts before SSO migration completes
- Legitimate research use of public GenAI documentation pages misclassified as a dlp_profile hit

**Tuning notes:** Tune the dlp_profile / DlpProfile regex to match your CASB's actual DLP category taxonomy; exclude any approved personal-account pilot users via an allow-list lookup to avoid alert fatigue during SSO migration windows.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Shadow AI Account-Switching Evasion — Personal/Managed GenAI Session Alternation (locked: unlock with TL Creds)
- MCP Confused-Deputy Privilege Escalation — OAuth Token Reused Across Distinct Users (locked: unlock with TL Creds)
- MCP Agent-Message Exfiltration to Attacker-Controlled Endpoint Post-Update (locked: unlock with TL Creds)
- Sensitive Data Pasted to Personal/Unmanaged GenAI Web Endpoint (locked: unlock with TL Creds)
- MCP Tool Shadowing / Typosquatting Detected in Tool Registry (locked: unlock with TL Creds)
- MCP-Adjacent Package Version Change Alters Outbound Network Behavior (Supply-Chain Rug Pull) (locked: unlock with TL Creds)
- MCP Tool Manifest Poisoning — Hidden Instruction in Tool Description/Schema (locked: unlock with TL Creds)
- MCP/npm-Style Supply-Chain Rug Pull — Package Update Followed by New Outbound Egress (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Risky shadow AI use remains widespread](https://www.cybersecuritydive.com/news/shadow-ai-security-risks-netskope/808860/)
- [Risky shadow AI use remains widespread](https://www.ciodive.com/news/shadow-ai-security-risks-netskope/808880/)
- [Beyond Shadow AI: The Netskope AI Report](https://www.netskope.com/blog/beyond-shadow-ai-the-netskope-ai-report)
- [Netskope Threat Labs: Shadow AI Risks Proliferate as GenAI Platforms and AI Agents See Rapid Adoption](https://www.netskope.com/press-releases/netskope-threat-labs-shadow-ai-risks-proliferate-as-genai-platforms-and-ai-agents-see-rapid-adoption)
- [The Rise of Shadow AI: What Netskope's 2026 Report Means for GRC Teams](https://medium.com/@brittneyaginther/the-rise-of-shadow-ai-what-netskopes-2026-report-means-for-grc-teams-e813102d17fb)
- [Netskope adds MCP controls to secure enterprise AI use](https://securitybrief.com.au/story/netskope-adds-mcp-controls-to-secure-enterprise-ai-use)
- [11 Emerging AI Security Risks with MCP (Model Context Protocol)](https://checkmarx.com/zero-post/11-emerging-ai-security-risks-with-mcp-model-context-protocol/)
- [Enterprises are racing to secure agentic AI deployments](https://www.helpnetsecurity.com/2026/02/23/ai-agent-security-risks-enterprise/)
- [CISA Agentic AI Guidance: A Practitioner's Roadmap](https://labs.cloudsecurityalliance.org/research/csa-research-note-cisa-agentic-ai-guidance-practitioner-2026/)
- [New Joint Guide Advances Secure Integration of Artificial Intelligence in Operational Technology](https://www.cisa.gov/news-events/news/new-joint-guide-advances-secure-integration-artificial-intelligence-operational-technology)
- [OWASP Top 10 for Large Language Model Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/)
- [CSAI Foundation: Shadow AI Asset Blindness Systemic Risk Whitepaper](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/04/CSA_whitepaper_shadow-AI-asset-blindness-systemic-risk_20260402-csa-styled.pdf)
- [Introducing the Model Context Protocol](https://www.anthropic.com/news/model-context-protocol)
- [Agentic AI Threat Modeling Framework: MAESTRO](https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro)
- [Agentic AI Red Teaming Guide](https://cloudsecurityalliance.org/artifacts/agentic-ai-red-teaming-guide)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1735