Analyst Chat #300: Shadow Agents and the Next Identity Crisis
From KuppingerCole Analysts by KuppingerCole Analysts
May 26, 2026 · 15 min
About this episode
In this 300th episode, Matthias and Martin Kuppinger discuss the emerging security risks posed by employees deploying their own AI agents without oversight.
Shadow IT was manageable. Shadow AI was concerning. Shadow agents? That's a whole different problem. 300 episodes already? Time flies when you're having fun! In this 300th Episode of the KuppingerCole Analyst Chat, Matthias sits down with Distinguished Analyst Martin Kuppinger to unpack one of the most urgent, and underestimated, security challenges facing organizations right now: employees building and deploying their own AI agents, with no governance, no oversight, and no accountability. Key topics: ✅ What "shadow agents" are and why they're fundamentally different from shadow IT or shadow AI ✅ Why vibe coding means anyone, not just developers, can now deploy autonomous agents inside your systems ✅ How AI agents massively expand the attack surface through prompt injection, data exfiltration, and uncontrolled access ✅ Why discovery and resource-side controls must happen in parallel and why neither alone is enough ✅ What organizations can actually do to gain control without just shutting everything down The bottom line: there's a thin line between agents that help your business and agents that harm it. Right now, most organizations can't tell the difference.
People in this episode
Host: Matthias
Guest: Martin Kuppinger
Topics covered
- shadow agents
- AI governance
- security challenges
- employee autonomy
- attack surface
- data exfiltration
- resource controls
Keywords
- shadow IT
- shadow AI
- vibe coding
- autonomous agents
- prompt injection
- data security
- organizational control
Mentioned in this episode
Organizations: KuppingerCole Analysts
More episodes of KuppingerCole Analysts
- Is Your CDN Secure? CDN vs. DDoS Mitigation Unpacked with Qrator Labs · June 12, 2026 · 17 min
- Analyst Chat #302: PAM Is No Longer a Vault - The New Identity Security Layer · June 8, 2026 · 35 min
- Analyst Chat #301: Know Your Attack Surface - ASM, DRP & Brand Protection · June 1, 2026 · 27 min
- Analyst Chat #299: AI Security Fabric - Identity, Governance & Authorization for Autonomous Agents · May 11, 2026 · 56 min
- Analyst Chat #298: Why AI Is Becoming Foundational to Cybersecurity · May 4, 2026 · 32 min
- Analyst Chat #297: AIdentity and the Limits of IAM · April 28, 2026 · 20 min
Explore listener stats, chart rankings, contacts and more on the KuppingerCole Analysts podcast page.