The AI Is Calling From Inside the House: A Third-Party Risk Horror Story
by Matthew Martin, Director, Cyber Advisory and Tech Enablement
It was a dark and stormy night, and the office had emptied early. Rain worked at the windows, and the motion-sensor lights clicked off one row at a time until only a corner of the floor was lit. A sales manager was still at her desk, clearing her inbox before a big week. When a consent screen asked her to let a new AI note-taker in, she did. It settled into her calendar first, then her email, then every recorded call she had ever had with a customer.
Two floors down, a finance analyst finished the automation he had been building all week. It worked on the first try, and he went home pleased. From that night on, invoices would leave the shared drive for a spreadsheet tool he had found online, and no one would think to ask where they went.
By Friday, two new third parties were living in the house. They held customer and financial data, and neither one had a vendor record.
Verizon’s 2026 Data Breach Investigations Report found a third party involved in 48% of breaches, up from 30% the year before. The same report shows that 45% of employees now regularly use AI on their corporate devices, up from 15%, and that shadow AI became the third most common non-malicious insider action in Verizon’s data loss prevention data.
Most third-party risk programs assume a new vendor arrives through procurement, with a contract to negotiate and a questionnaire to send. That assumption no longer holds. Employees bring in SaaS and AI tools on their own in a few clicks, and citizen developers connect those tools to each other and to company data. The security teams I work with try to review each one as it surfaces, and they can’t keep up. What I’ve seen work starts smaller. Go find what’s already plugged in, and figure out which of it could really hurt you. Then make the approved option easy enough that people stop going around it.
If your company is the house, procurement is the front door and for twenty-five years, employees have been finding other ways in and out.
Hidden Passages
In 1999, Salesforce launched on the promise that a business could run its software from a browser, and once people learned the trick, they no longer needed IT to install anything. File-sharing and collaboration apps soon followed. The ease with which these tools could be onboarded was seen as a revolutionary way to reduce friction and create process efficiencies. But it had a darker side. Something began to grow in the parts of the house IT couldn’t see. It fed on copies of customer files sitting in unmanaged accounts, and on the logins of employees who had left years earlier. It never went through a security review or showed up in an audit, so the first time anyone saw it was usually during an incident. It was no surprise when the thing in the walls was finally given a name: shadow IT.
In 2012, OAuth 2.0 gave apps a standard way to access your accounts without seeing your password. It was seen as a safer, simpler way to connect tools, and in many ways it was. But some of what came in through those consent screens never left. Apps from pilots that ended years ago still wandered the CRM at night, reading records for people who had long since left the company. Their tokens never had to get past a password or a second factor, so they came and went without a sound. Few companies knew how many skeletons were rattling around in their closets.
Security teams spent the next decade going room to room with flashlights. Firewall and proxy logs showed which cloud services traffic was flowing to. Cloud access security brokers sat between users and those services, flagging unsanctioned apps and enforcing data policies on the ones the company allowed. Single sign-on gave every app the same login, so disabling an account actually closed it. SaaS management platforms combed expense reports and OAuth grants for subscriptions that never went through IT, and SaaS security posture tools checked the settings inside the apps the company did approve. Behind all of it, acceptable use policies told employees which tools were allowed and what data could go into them. Security teams finally had a map of most of the passages, and for a while that felt like enough.
A New Shadow Hangs Over Third-Party Risk Management
One night in late 2022, not so unlike tonight, the phone rang. ChatGPT had arrived. At first it was a curiosity people whispered about at the water cooler. People who had talked to it couldn’t agree on what it looked like, how it worked or where its limits were. It wrote and summarized and answered almost like a person, and every few months it could do something new. People pasted in drafts, spreadsheets and the occasional contract just to see what it would say.
And it was hungry. Every prompt, file and spreadsheet only made it want more, like Audrey II in Little Shop of Horrors shouting “Feed Me, Seymour!”, and the people complied. Employees started using generative AI for real work, and vendors began switching on AI features inside tools companies already owned. Before long, the people who live here, most of them just trying to get through a busy week, started using these new tools to dig passages of their own. Low-code platforms had already let business users build their own apps and automations. AI agents and connectors, including the Model Context Protocol introduced in late 2024, made it simple to wire a model straight into email, file shares and the CRM. Then the phone rang again. The voice on the line knew the quarterly numbers, the customer list and what legal had said in last week’s meeting. It was calling from inside the house. The age of Shadow AI was upon us.
SaaS signups, OAuth grants, AI assistants, vendor AI features and homegrown agents had quietly connected company data to a long list of outside services. Each of those connections is a third-party relationship with delegated access. The Salesloft Drift campaign showed what attackers do with that kind of access: they stole the app’s OAuth tokens and used them to pull customer data out of Salesforce.
Keeping track of all those connections falls to third-party risk teams, and they were never staffed for this. In Ncontracts’ 2026 survey of 173 financial services professionals, 63% of third-party risk programs ran with one or two dedicated people, more than half managed 300 or more vendors, and 72% said they were only partially aware of which vendors use AI.
Pull Off the Mask
Anyone who watched Scooby-Doo knows how every episode ends. The gang pulls the mask off the monster in the haunted house and finds someone ordinary underneath. Unmasked, shadow AI is a set of connections, each one reading or writing some piece of company data. When I talk with leadership teams about AI, the worry I hear most is that no one knows which connections touch what. You can answer that without locking every door or taking everyone’s keys.
Pulling off the mask starts with finding out what’s actually connected, and the tools that matter are often in use long before anyone reviews them. OAuth grants in your identity and productivity platforms, SSO logs, expense reports and browser telemetry show which SaaS and AI tools are in use and what they can reach. That old map still helps, but it was drawn before AI started showing up inside apps the company had already approved, so it needs a fresh look. The access itself is the part you control. Verizon found that only 23% of third-party organizations fully remediated missing or improperly secured MFA on their cloud accounts, so narrowing or revoking a grant is often the fastest fix available.
I’ve never met a security team that could review every tool an employee connects, so I tell clients to start with blast radius. Look at what each connection could reach if it went bad. A business impact analysis names the processes and data the company can’t run without, and that list turns an endless discovery feed into a short queue. The note-taker with access to customer calls goes to the front of the line. The free diagramming tool with no data access can wait its turn. Most people get to keep their keys, and the ones holding access to what matters get a closer look.
- Inventory the access, grant by grant. Record each token, connector and service account with the data it touches and who approved it.
- Tier tools by the data and permissions they hold. A free tool with read access to the CRM outranks a paid one that touches nothing sensitive. Once a tool’s blast radius crosses your threshold, it gets a vendor record and due diligence sized to its tier.
- Give every connected tool a business owner. The person who adopted it, or their manager, decides whether the value is worth the remaining risk, and security sets control expectations and validates them. Build that RACI with the business so ownership is shared from the start.
- Reassess on change and revoke on exit. A widened permission, a newly enabled AI feature or a vendor breach in the news triggers a review, and access ends when the tool or the employee leaves. When an existing vendor switches on AI, ask which model provider now sees your data. That provider is a fourth party you’ve never assessed.
Make the Front Door the Easy Way In
Ranking what’s inside only helps if the next tool comes in through the front door. People route around slow approvals, and citizen developers are no exception. They’re solving real problems, and a review that takes months pushes the next tool out of sight. The goal is a front door that’s faster than any passage behind the walls.
- Size the intake to the risk. Low-risk tools get a short form with an AI addendum covering model use, training on your data and where prompts and outputs are stored, with a decision in days. Tools that reach critical data also get contract terms covering data processing, retention and subprocessors.
- Publish what’s approved. Showing which AI tools and connectors are sanctioned, and what each one is approved for, answers many requests before anyone has to ask.
- Register what citizen developers build. Each agent and automation gets an entry with its permissions, the data it touches and the person accountable for it, and a review when its scope grows.
Where to Start
If I were starting tomorrow, this is the order I’d take it in.
- Run discovery before writing new policy. Pull OAuth grants, SSO logs and expense data to see what’s connected today.
- Rank what you find by blast radius. Tools that reach critical data and processes get reviewed first.
- Bring high-blast-radius tools into the vendor program. Give them a vendor record, due diligence sized to their tier and contract terms that cover how your data is used, and ask existing vendors which AI providers now see your data.
- Name a business owner for every connected tool. Agree on the RACI so risk decisions sit with the people getting the value.
- Stand up a fast intake for AI tools and connectors. Aim for decisions in days, and publish the approved list.
- Track maturity over time. Measure discovery coverage, time to approve and how fast risky grants get narrowed or revoked. Those numbers make the case for funding the program as adoption grows.
- Choose partners by the decisions they help you make. Look for help connecting third-party exposure to business impact and real attack paths, and judge it by whether your team can act on the output.
Back to That Stormy Night
Go back to that dark and stormy night. This time, when the note-taker slips into the sales manager’s calendar, it shows up in the next discovery pull. Its reach into every customer call puts it at the front of the line, and by Friday it has a vendor record, an owner and a decision, along with a sanctioned option she can use without working late to find it. The analyst’s automation lands in the register too, and the spreadsheet tool behind it gets a closer look. Both of them kept their keys.
The calls will keep coming from inside the house. The difference is that now you know who’s on the line. Pull off the mask, rank by blast radius, and make the front door the easiest way in.