September 8, 2026
Compliant Is Not Correct: The AI Gave Us the Wrong Hashcat Mode
Compliant Is Not Correct: The AI Gave Us the Wrong Hashcat Mode
Omair
New Update: Our new blog is updated.
Free download
Omair Manzoor is the Founder, CEO, and Chief Hacker of ioSENTRIX, a CREST-accredited cybersecurity firm. With 14+ years in offensive security, he has led penetration tests for Fortune 500 companies including engagements for Amazon, Bank of America, VISA, and the London Underground. His exploits are part of the Metasploit Framework and Immunity Canvas. Omair is a published researcher, conference keynote speaker (DOD, CISA, BSides), and technical reviewer for academic security textbooks.
Your quarterly AI attestation came back clean. One approved assistant, enterprise tier, SSO enforced, DLP in front of it. No unsanctioned AI tools found.
The attestation is probably accurate. It is also close to meaningless, because it answered the question "what AI did anyone buy?" — and almost nobody buys AI anymore. They get it in a release.
The question it did not ask is the one most mid-market security teams cannot answer: how many of the products you already approved and reviewed are now processing your data with a model? None is shadow IT. Every one was sanctioned. And the AI inside them is almost certainly not in your inventory.
For a decade, shadow IT arrived: someone signed up for something, traffic went to a new domain, and you caught it in the proxy, the expense report, or the OAuth grant log. Arrivals can be seen.
Embedded AI does not arrive. It switches on. A CRM ships a summarize-this-account panel in a point release. A helpdesk starts drafting replies. A document system swaps keyword search for semantic search backed by a model. A workflow tool adds an AI step any business user can drop into a flow — the governance problem we described in low-code and no-code environments, now with a model attached. None of it generates a purchase order or triggers a vendor security assessment, because the vendor is not new. Approval has a shelf life nobody prices in.
This is not a discipline failure. Embedded AI is invisible to the standard toolchain for four structural reasons.
No procurement event. The AI arrived in release notes, not a contract. The one contractual artifact that does change — the sub-processor list, when inference runs on a model provider added after your review — updates on a notice period that lands in a legal or procurement inbox. Security is rarely on that list.
No new destination. Proxy and network discovery key on new domains and certificates. An AI feature inside an approved app talks to the same host it always did, over the same session, under the same OAuth grant. At the network layer, nothing happened.
No new permission request. An embedded assistant generally reads what the requesting user could already read. The permission model did not change; the *retrieval* surface did. Oversharing that survived for years because nobody could find the file is now one question away — the lesson of RAG security, applied to a corpus you never chose to index.
No single place to look. The switch governing AI in each product lives in that product's own admin console, under a name that vendor chose. Nowhere in your identity provider, CMDB, or SaaS management tool is "is AI enabled" queryable across the estate.
One result: the fastest-growing category of AI processing in a mid-market company is the category nobody counted.
*A synthetic composite, assembled from patterns we see across engagements. Not a client, and not any single organization.*
A 600-person specialty insurance brokerage writes a clear AI policy: one approved assistant, no customer data in consumer tools, quarterly attestation signed by department heads.
Over two quarters, four things happen the policy does not cover. Their CRM enables account summarization for everyone when a tenant default flips on. Their support platform starts drafting replies over ticket history, which holds claim details. Their document platform indexes the shared drive for semantic search, including the folder where underwriting keeps loss runs. And someone in finance builds an automation piping spreadsheet rows through an AI step.
Four AI processing paths. Zero new vendors. Zero policy violations, read literally. Zero inventory entries.
The one thing the policy *did* catch was an analyst pasting a document into a personal chatbot account. A genuine finding — and the smallest of the five, because it moved a document. The embedded features moved the corpus. That path is one of the five paths customer data takes around an AI policy we mapped previously, and the one that most reliably escapes a policy written in nouns.
The fix is not a longer list of banned products. It is a different noun. Stop inventorying vendors; inventory capabilities — every place where text can cross a trust boundary and reach a model. Three questions per capability, each with a test attached, because a capability you have named but not tested is still an assertion.
What can it read? Test it as a user. Sign in with a standard account wherever an AI feature is on, ask the assistant for something that account should not surface — a compensation figure, a legal matter, a record outside the user's book of business — and record what comes back. Retrieval scope beyond intended scope is a finding, and it travels with the prompt, the response, and the account it ran under.
Where does the text go? Part observable, part contractual, and the two should not be confused. Observable is egress: seed unique synthetic records, then hunt them in proxy, DNS, and DLP logs. Not observable is vendor-side retention. As we said when we introduced the canary technique, a canary proves egress you can watch — not what a vendor kept. Retention is a contract term, verified by reading rather than testing.
What can it do? Read-only summarization is one risk class. A feature that can send a message, update a record, or call another system is another, and it inherits the OWASP work on agentic AI threats and every property we argued matters for an autonomous action worth trusting: genuine, authorized, untampered, reconstructable. The cheapest useful test is whether the feature follows instructions embedded in the content it processes — prompt injection testing aimed at a ticket body rather than a chat window, against techniques cataloged in MITRE ATLAS.
Answering those across an estate takes more than one signal — identity logs, tenant admin APIs, expense data, browser telemetry, network egress — and the network layer is structurally blind here. How to combine them, and how to rate the resulting inventory's confidence, is its own subject; we will treat it separately. The narrower point: a policy list is not a discovery method, and never was.
None of this makes AI in SaaS a bad idea. Most of these features are useful. The goal is to know they are on, know what they touch, and show your work — the inventory the NIST AI Risk Management Framework, the CSA AI Controls Matrix, and the OWASP Top 10 for LLM Applications all assume before their controls mean anything. Alignment is not certification. ISO/IEC 42001 is certifiable, but certifies a management system — not that your CRM's assistant respects a permission boundary on a Tuesday.
Three questions, in scoping-call order:
1. Which of your top twenty SaaS applications shipped an AI feature in the last twelve months, and who decided whether it was on?
2. For each one that is on, can you say what it can read — from a test, not from the vendor's documentation?
3. For each one that can act, do you have a log that would let you reconstruct what it did and on whose authority?
If the honest answer is "we would have to go look," that is the normal starting position — and better than a clean attestation nobody stress-tested. A gap between policy and reality is only dangerous while it is unmeasured, which is the point behind everything we write on assessing a control versus proving one.
ioSENTRIX is a CREST-accredited offensive security firm. We assure the stack you already chose; we do not sell a platform that competes with it. For embedded AI that means a discovery pass treating capabilities as the unit of inventory, hands-on validation of what each enabled feature can retrieve and do under a real user's credentials, and adversarial testing where a feature can act rather than only summarize. What comes back is evidence — the attempt, the observed result, the artifact, the conditions — not a control matrix with checkmarks. Independent adversarial testing produces that evidence whoever performs it, because the tester has no stake in the answer.
To see what a capability-level inventory turns up in your environment, start a conversation with us. Mid-market teams often find a continuous testing model fits better than an annual snapshot, for the reason the blind spot exists at all: the products keep changing.
