Orca Security: Shadow AI Governance

What it is

An Orca Security blog post laying out the operating machinery of a shadow AI governance program. The catalog summary already has the scoping test, the shadow-IT remediation gap, the seven-field inventory, the four dispositions, and the ISO 42001 / CSA mapping. What it omits is a set of hard limits on the tooling and a few concrete numbers an engineer would need before promising coverage.

The vendor-tooling limits the summary skips

The page is unusually specific about where Microsoft's shadow AI detection (still in public preview) stops, and these are the details that decide whether "we'll block it" is true:

• Microsoft's preview lists seven named agents. Detection is available for all seven; blocking works for exactly one.
• Blocking applies only to managed Windows devices enrolled with Microsoft Intune, and takes anywhere from 15 minutes up to 8 hours to apply.
• Named desktop agents in the preview include ChatGPT Desktop, Ollama Desktop, and Claude Desktop.
• Microsoft's built-in low-risk consent policy allows user consent only for apps from verified publishers and for permissions classified as low impact.

Access revocation doesn't do what you think

A separate concrete point on the identity side: removing an OAuth grant "doesn't stop users from re-consenting." User-consent grants cannot be revoked in the admin portal — only through the Graph API or PowerShell. This is why the page argues remediation needs a fourth step (what left, to whom, under what terms) rather than the shadow-IT discover/approve/onboard/retire cycle. The page also points to the OWASP Non-Human Identities Top 10 as effectively a shadow-AI document, since OAuth grants and SDK keys both end in a credential no human logs into.

Numbers and ordering worth reproducing

• CSA AI Controls Matrix v1.1: 247 control objectives across 18 domains, with a published ISO 42001 mapping. (Summary names the matrix but not its size.)
• ISO/IEC 42001:2023: published December 2023, stage 60.60.
• Program metrics to report: new systems found this month, median time to disposition, exceptions past expiry, and registered systems with a named owner — report the middle two "even when they look bad."
• Remediation ordering: fix app consent first (its approval queue doubles as a discovery feed), egress control second, the rest per your change calendar.

Caveats

Orca's own coverage is explicitly half the estate: cloud-side SideScanning reads cloud accounts only (Azure OpenAI, Bedrock, SageMaker, Vertex AI; 50+ AI packages; exposed keys in repos). The three surfaces it cannot see — desktop agents, browser sessions on personal accounts, and SaaS AI toggles — remain endpoint and SaaS problems. The Microsoft capabilities above are preview-stage and may change.