Shadow AI Risk and Control: A Practical Enterprise Guide

Somewhere in your company today, an employee is pasting a customer email, a contract clause or a block of source code into a public AI chatbot, using a personal account that IT cannot see. They are not trying to cause harm. They are trying to finish their work faster, and the tool in front of them is good at it. That is shadow AI: AI used for work without the knowledge, approval or oversight of IT, security or compliance.

Shadow AI is the natural result of a gap between what employees need and what the organization has sanctioned. The research on it is now extensive, and it points in one direction. Use is widespread, much of it is invisible, and bans on their own rarely work. This guide covers what the surveys say, how shadow AI creates security and compliance exposure, why policy alone fails, and how an approved, governed AI platform such as Higgins Enterprise gives people a safer path that they will actually choose.

Key takeaways

• Shadow AI is mainstream, not marginal. Microsoft's 2024 Work Trend Index found that 78% of AI users were bringing their own AI tools to work, and a 2026 BlackFog survey found 49% of workers had adopted AI tools without employer approval.
• The risk is concrete. IBM's 2025 research tied shadow AI to 20% of breaches and found that organizations with high levels of it paid $670,000 more per breach.
• Bans push use out of sight. Employees who believe there is no approved option often decide that speed is worth the risk.
• The durable answer is enablement: give people a sanctioned, capable platform with centralized permissions and usage controls, then write policy that points to it.
• Start with discovery, not punishment. You cannot govern what you cannot see.

What shadow AI is, and why it keeps growing

Shadow AI is the AI-era version of shadow IT. In the 2010s, employees signed up for file-sharing and project tools on their own because the sanctioned options were slow. Security teams spent years bringing those tools under management. Shadow AI repeats the pattern, but with two differences that raise the stakes.

First, the unit of exposure is different. A file-sharing app stores files. A generative AI tool receives the actual content of work: the draft, the dataset, the code, the question that reveals a strategy. Second, adoption is faster. A browser tab and a free account are all that is needed, and the productivity benefit is felt within minutes, which is exactly why the habit spreads.

Shadow AI takes several forms, and it helps to name them because each needs a different control:

• Public chatbots on personal accounts. The most common form. The employee uses a consumer account, outside any enterprise agreement.
• Free tiers of approved tools. Even where a company licenses an AI product, some staff use the free version instead, with weaker data protections.
• Embedded AI features and browser extensions. Transcription bots, summarizers and writing helpers that attach themselves to meetings, email and documents.
• Unapproved connectors. An AI tool linked to a work system, such as a drive, calendar or ticketing platform, without IT review.
• Homegrown scripts and agents. Technical staff who wire a model API into a workflow, sometimes with production credentials.

The underlying cause is rarely malice. It is usually friction. If the approved path means a six-month wait, a restricted tool that cannot see the right data, or no tool at all, a motivated employee will find another way. Our post on why enterprise AI pilots fail describes the same pattern from the project side: when the sanctioned option is too limited, usage drifts elsewhere.

How widespread is shadow AI? What the surveys say

Several independent sources now measure the scale, and while the numbers vary with method and sample, the direction is consistent.

Microsoft and LinkedIn's 2024 Work Trend Index, based on a survey of 31,000 people across 31 countries, reported that 75% of knowledge workers used AI at work and that 78% of AI users were bringing their own tools to work, a pattern the report calls BYOAI (Microsoft, 2024).

A BlackFog survey of 2,000 workers at companies with more than 500 employees, reported by CIO in January 2026, found that 49% had adopted AI tools without employer approval and 51% had connected AI tools to work systems or apps without IT's approval or knowledge. It also found that 63% believed using AI was acceptable when no approved option exists, and 60% said speed was worth the security risk (CIO, 2026).

Security leaders see the same thing from their side. Gartner reported that 69% of surveyed cybersecurity leaders had evidence or suspected that employees were using public generative AI at work, and predicted that by 2030 more than 40% of global organizations will suffer security and compliance incidents due to unauthorized AI tools (Infosecurity Magazine reporting on Gartner, 2025).

Shadow AI by the numbers

One finding in the BlackFog data deserves special attention. Senior leaders were not the cautious voice. The survey reported that 69% of presidents and C-suite members and 66% of directors and senior vice presidents appeared to accept unsanctioned use. That matters because policy enforcement depends on example. If executives treat speed as the priority, staff will too.

What employees actually paste into public tools

Surveys of attitudes are useful, but it is the behavior that creates exposure. Browser-level telemetry from security vendor LayerX, reported by TechRadar in October 2025 from its Enterprise AI and SaaS Data Security Report 2025, found that 45% of enterprise employees used generative AI in some form. Among those users, 77% had copied and pasted data into a GenAI tool, and 22% had pasted personally identifiable or payment card information. Notably, 82% of pastes came from unmanaged personal accounts, which leaves enterprises with little visibility into what was shared (TechRadar, 2025).

What sits behind the shadow AI problem

View chart data

Item	Value
Employees using generative AI in some form	45%
GenAI users who have pasted data into a GenAI tool	77%
GenAI users who have pasted PII or payment card data	22%
Share of pastes made from unmanaged personal accounts	82%

The BlackFog survey adds detail on what is shared. Among respondents, 33% admitted sharing enterprise research or datasets with unsanctioned tools, 27% had revealed employee data such as salary or performance information, and 23% had entered company financial information.

Categories of company data shared with unsanctioned AI tools

View chart data

Item	Value
Enterprise research or datasets	33%
Employee data such as salary or performance	27%
Company financial information	23%

These are admissions, so real figures may be higher, and sampling differs between vendors. Treat the numbers as a directional picture rather than a precise measurement. The pattern, though, is clear enough to plan around: employees are sending real company data into tools the company does not control.

A well-known example from 2023 illustrates how this can play out. Press reports, including by The Register, said Samsung restricted staff use of generative AI after employees uploaded sensitive internal code to a public chatbot. The lesson was not that one company was careless. It was that ordinary, helpful behavior can leak valuable information when nothing sanctioned exists.

Why shadow AI is a security, compliance and business risk

It is tempting to treat shadow AI as a policy irritation. The consequences are more serious, and they fall into five groups.

Data leakage and loss of control

Once company data is entered into a consumer service, you have limited control over retention, use for model improvement, human review or deletion. Depending on the provider and plan, those terms vary widely, and employees seldom read them. IBM's 2025 research found that in shadow AI incidents, 65% involved customer personally identifiable information, compared with a 53% global average across all breaches, and that 62% involved data stored across multiple environments (Kiteworks summary of IBM, 2025).

Regulatory and contractual exposure

Privacy and sector rules do not pause because the tool was unofficial. Personal data sent to a public service without a lawful basis or a processing agreement can breach GDPR. Protected health information sent without a business associate agreement can breach HIPAA. Customer contracts often restrict where data can go. In regulated work, pasting controlled content into an outside tool can break the integrity and access expectations behind rules such as 21 CFR Part 11. Our guide to enterprise AI governance, security and compliance walks through these regimes.

Intellectual property and trade secrets

Unreleased product designs, pricing models, research data, source code and legal strategy are the kinds of material that lose value if they are disclosed. Disclosure through an AI prompt may also complicate later claims that the information was kept confidential.

Quality and decision risk

Unvetted tools produce unvetted answers. When employees rely on a general-purpose model that has no access to your actual procedures, they may act on plausible but wrong guidance. In quality, safety or regulatory work, that is not a small problem.

Invisible agents and connections

The newest risk is tools that do not merely receive text but act. An unapproved AI assistant connected to email, files or a ticketing system can read and write across systems with whatever access the employee has. This is where shadow AI meets prompt injection and excessive agency, and why agentic AI should always be introduced inside a governed platform.

What shadow AI costs when it goes wrong

IBM's Cost of a Data Breach Report 2025 gave the most useful financial reading so far. It found that shadow AI was involved in 20% of breaches, compared with 13% for sanctioned AI systems, and that organizations with high levels of shadow AI averaged $670,000 higher breach costs than those with low or no shadow AI. Reported averages were $4.63 million for breaches with high shadow AI against $3.96 million for standard incidents (IBM, 2025; Kiteworks summary).

Average breach cost with and without high shadow AI

View chart data

Item	Value
Standard incidents	$M3.96
High shadow AI	$M4.63

The same report found governance lagging behind: 63% of breached organizations had no AI governance policy or were still developing one, and of those with a policy, only 34% performed regular audits for unsanctioned AI. In other words, many companies have written rules but cannot verify whether anyone follows them.

Why bans and policy-only approaches fall short

The first instinct is often to block the biggest chatbots at the firewall and publish a stern policy. This is understandable and sometimes necessary in the short term, particularly for the most sensitive data. As a complete strategy, though, it has three weaknesses.

It does not remove demand. The need that drove adoption, getting through administrative work faster, remains. In the BlackFog survey, 63% of respondents said AI use was acceptable when no approved option exists. A ban without an alternative simply teaches people to hide what they do. Microsoft's data points the same way: people bring their own tools when the workplace does not provide enough.

It cannot see everything. Personal phones, personal laptops and new tools appear faster than block lists update. Embedded features arrive inside tools you already use. The attack surface is the workflow, not a list of domains.

It treats symptoms. If the policy never asks why people go outside the lines, the underlying gaps stay in place: slow procurement, tools that cannot reach the right data, and no training on safe use.

The last row is the one that scales. It does not replace the others. You still need a clear policy and some blocking of high-risk services. But enablement is what turns policy from a hope into something that works.

The approved AI platform approach

An approved AI platform strategy gives employees a safe default that is at least as useful as the tools they would otherwise find. It has six parts.

1. Discover. Use network and endpoint telemetry, SaaS discovery, expense data and surveys to find what is in use. Frame it as listening, not a witch hunt, so people tell you the truth.
2. Classify. Sort use cases by data sensitivity and regulatory exposure. Some uses can proceed widely, some need tight controls, and a few should be prohibited outright.
3. Provide. Offer a sanctioned platform that covers the real jobs people are doing: finding information, drafting, summarizing meetings, preparing reports.
4. Govern. Centralize permissions and usage, so access follows roles and sensitive data stays within a defined boundary.
5. Train. Teach people what is safe to enter, what to verify and how to use the approved tool well. Short, practical onboarding beats long policy documents.
6. Monitor and improve. Review usage, adjust permissions, retire redundant tools and ask users where the platform falls short.

From shadow AI to a governed platform

1. DiscoverFind which AI tools and connectors are in use and why.
2. ClassifyRank use cases by data sensitivity and regulatory exposure.
3. ProvideOffer a capable sanctioned platform for the real jobs.
4. GovernCentralize permissions, usage controls and data boundaries.
5. MonitorReview usage, close gaps and keep listening to users.

The test of the sanctioned platform is simple. If people use it voluntarily, shadow AI shrinks. If they do not, they will route around it, and the fault is in the platform or the rollout, not the people.

How Higgins offers a sanctioned, governed alternative

Higgins is an enterprise AI platform from higgins.ai built to sit in front of the applications a company already runs and give every associate one assistant. It retrieves information, finds standard procedures, forms and reports, summarizes email, captures meeting minutes and action items, and automates administrative work. For a security team, the interesting question is how that maps to the shadow AI problem.

It gives people a reason to switch. Shadow AI exists because employees want help with administrative work. Higgins is aimed squarely at that burden, which is the reason it is described as streamlining admin so people can spend time on creative and innovative work. Because it connects to company systems and answers questions from them, it can serve needs a public chatbot cannot, such as locating the right SOP or summarizing the current state of a project.

Company data stays inside the environment. Higgins is built as a Safe and Secure AI Environment in which company data and intellectual property are not permitted to leave the company's environment. External information requests can go out and answers return without exposing company data or IP. That is the opposite of pasting into a public tool.

Permissions and usage are centrally governed. Higgins can run as a global, standardized internal AI with usage and permissions governed centrally, by corporation, function and department, and tuned at team and individual level. Security can decide who gets which assistant and which data, instead of discovering it after the fact.

It is designed for your approval process. Higgins is designed to be approved through the customer's IT process, including risk assessments, security testing and API security testing. It is also designed to support HIPAA, GDPR, SOC 2, 21 CFR Part 11 and similar regimes; as with any vendor, confirm scope for your deployment, since this is design intent and not a claim of certification.

It starts without touching company data. Phase I of implementation offers Best Practices AI that is not connected to company data, so associates can build familiarity with discipline-specific AI immediately, while IT approval for connected phases proceeds. Later phases connect to limited repositories such as SharePoint, Teams and ServiceNow, and then to systems such as Polarion, Veeva, Tableau or PLM through APIs. A sandbox, pilot and beta path keeps the blast radius small. See implementation and integrations.

Pricing follows use. Higgins pricing is based on usage rather than number of users or annual seat fees. That has a governance benefit that is easy to miss: you do not need to ration access to control cost, so you can make the sanctioned tool broadly available to the people who would otherwise go elsewhere. More on this in measuring AI ROI with usage-based pricing.

Read more on security and compliance and the Higgins Enterprise overview.

A 30-60-90 day playbook for reducing shadow AI

You can make visible progress in a quarter. The following sequence suits most mid-size and large organizations.

Days 1 to 30: listen and learn. Run an anonymous survey and short interviews. Ask which tools people use, what for, and what stops them using approved ones. Review network, browser and SaaS logs for AI domains and extensions. Block only the highest-risk services at first, such as those that retain data for training under consumer terms. Pick an executive sponsor who will publicly follow the same rules.

Days 31 to 60: provide and publish. Stand up the sanctioned platform for a first group, starting with use cases that carry modest data risk. Publish a short acceptable-use policy in plain English with three lists: what is always fine, what needs approval, and what is never allowed. Offer a concrete migration path, such as "move your meeting notes and email summaries here." Put quick-start training in the first week. Higgins' own 7-day onboarding, from creating your profile to bringing a work AI into your daily routine, is an example of how short that can be.

Days 61 to 90: govern and expand. Move from pilot to a wider beta. Extend connections to more systems in stages, with security testing at each one. Start monitoring usage against permissions, and review exceptions with managers rather than with disciplinary letters. Retire or contractually cover remaining unsanctioned tools. Report back to staff on what you changed because of their feedback, which builds the trust that discovery depends on.

Take care to treat the first listing of tools as a map, not a charge sheet. Staff who fear punishment stop reporting, and visibility is the one thing you cannot afford to lose.

Measuring whether control is working

Governance without measurement drifts. Choose a handful of indicators and review them monthly:

• Sanctioned share of AI activity. The proportion of AI use that happens on approved platforms, as estimated from logs and surveys.
• Unsanctioned tool count. The number of distinct unapproved AI services detected, trending down over time.
• Time to approve. How long a request for a new AI capability takes from submission to decision. Long waits create shadow AI.
• Access review completion. The percentage of permissions reviewed on schedule.
• Incidents and near misses. Reported events, including voluntary reports, which are a sign of a healthy culture.
• Adoption and satisfaction. Whether people actually prefer the sanctioned tool.

Balance control metrics with value metrics. A platform that is locked down but unused is a failure of a different kind. For a wider view of success measures, see AI governance, security and compliance and our discussion of the single source of truth, since good answers from trusted data are what keep people on the sanctioned platform.

Frequently asked questions

Next steps

Shadow AI is a signal of unmet demand. Meeting that demand with a platform your security team trusts is usually more effective than any list of banned websites. To see how Higgins can serve as your sanctioned AI, explore Higgins Enterprise, read what users say in our testimonials, learn the story about Higgins, or contact the team to plan a governed rollout. If you want your people to build safe AI habits, the Higgins Masterclass is a practical starting point.