Shadow AI is quietly driving an unmanaged identity crisis across the Asia-Pacific region, according to Keeper Security, with more than half of regional enterprises citing critical gaps in how they govern AI-related access.
In a commentary shared with TechCoffeeHouse, Takanori Nishiyama, Senior Vice President, APAC & Japan Country Manager at Keeper Security, argued that shadow AI breaks the playbook security teams built for shadow IT. Unlike static, unauthorised software of the past, modern AI platforms are deeply integrated, agentic workflows: when employees link AI assistants to enterprise calendars, cloud repositories and CRM platforms, they are granting persistent credentials, API keys and elevated data access to machine actors.
Breach costs tied to shadow AI are rising
IBM’s 2026 Cost of a Data Breach Report found that 43 per cent of breached organisations had experienced an incident involving shadow AI, up from 20 per cent a year earlier, with those breaches costing an average of US$5.39 million.
Keeper Security’s own Identity Security at Machine Speed report, which surveyed 3,200 cybersecurity decision-makers and senior IT leaders globally, including 500 across Australia, India, New Zealand and China, found that 53 per cent of APAC respondents identify AI-related non-human identity (NHI) management as a top gap in their identity governance, 10 percentage points above the 43 per cent global average. A further 47 per cent of APAC respondents cited a lack of visibility into the AI tools employees use, while just 38 per cent of APAC organisations have fully deployed a privileged access management (PAM) solution.
“An AI agent with access to a production database carries the same privileged access risk as a human administrator with equivalent permissions – and it operates at machine speed. Organisations should apply the same oversight they use for privileged administrators, including session review, access approval and regular recertification,” said Nishiyama.
Regulators across the region are moving first
Policymakers across APAC are increasingly treating AI agents as identities that require owners and limits. Singapore’s Infocomm Media Development Authority launched its Model AI Governance Framework for Agentic AI in January 2026, calling for every agent to carry a traceable identity linked to an accountable human, while the Cyber Security Agency of Singapore followed in June 2026 with a finalised addendum on securing agentic AI. Japan’s Ministry of Economy, Trade and Industry and Ministry of Internal Affairs and Communications introduced a formal definition of AI agents in version 1.2 of its AI Guidelines for Business in March 2026, and Australia’s National AI Centre has asked organisations to decide who is accountable and maintain human control over AI systems.
Nishiyama said organisations should extend identity-first security controls to every identity AI tools create, human and machine alike, with continuous discovery of sanctioned and unsanctioned AI tools, real-time monitoring of privileged sessions, and a move towards zero standing privilege, where AI agents are granted elevated access only for the task at hand before it is automatically revoked.
