Risk frameworks for unsanctioned tool usage, unmonitored API endpoints, browser extensions, and IP leakage.