An OAuth consent screen is a thin place for a procurement decision to land, and often it is the whole of the process: there is no meeting and no security review, just one click on Allow [10]. What comes out the other side looks like an assistant and may hold permission to read email, summarise files, reach customer records, open ticketing systems or interact with a source-code repository, in Klein's description [7].
Per-desk arithmetic makes the count easier to hold. An average of 414 unsanctioned tools per 1,000 employees is one for roughly every 2.4 people, so a 250-person company is carrying about 104 of them [2][1]. The 80 percent figure puts four unsanctioned tools beside every one IT has a record of [1][2]. Both numbers come from the telemetry of a company that sells agent security to enterprises, so the population being measured is organisations that already bought a scanner [13].
Teams often assume that disabling a leaver's account on their last day removes their access, but the OAuth grant they issued in March still resolves, and so does the service account they stood up for a three-month project. Klein says the departing-employee process can work exactly as designed while the integrations and delegated access that person created get far less attention [9], and that Reco routinely finds these orphaned agents on its first pass through a customer environment [8].
IBM's number is the one that will travel into budget decks, so read it the way the report states it. Across 600 breached organisations in 17 industries, one in five had a breach involving shadow AI, which is about 120 companies [3][3]. Organisations with high levels of shadow AI recorded breach costs averaging $670,000 more than those with little or none [4]. That figure is a gap between two groups of breached companies, not a price tag on any single unowned agent, though the article's own summary compresses it into "added" [5].
What the reporting does not give you is the split that would size the job: no share of those 414 tools that are orphaned, and no share that holds access to customer data, code or production [4]. That ranking has to come out of your own inventory.
Two questions produce a usable grid: whether the agent can reach customer data, code or production [12], and whether a named, currently employed person will answer a page about it. High reach with a live owner is paperwork, so move the credential onto a managed identity and put the owner's name on it. High reach with no owner is the cell to work first, because revoking there costs a workflow at worst and nobody is left to argue for it. Low reach with an owner can wait. Low reach with no owner is a cleanup queue for a quiet week.
The figure worth reporting upward is how many agents with reach into customer data, code or production have a human name against them, and whether that count improves month over month, rather than how many AI tools the scan found [12].
