Is Shadow AI a Security Problem or a Sign Your Approved Tools Are Failing?

By Victor Hoang · Updated Oct 11, 2026

Somewhere in your company right now, a salesperson is pasting a customer email thread into a personal chatbot account to get a reply drafted. A recruiter is running candidate notes through a browser extension. An analyst is asking a free assistant to clean up a spreadsheet. None of them think they're doing anything wrong. They're trying to finish the work in front of them, and the tool they were given either doesn't do it or takes three weeks to get access to.

That's the question for a leader: when people use AI tools you haven't approved, are you looking at a security problem, or at a report card on the tools you did approve? It's both. But the order matters. Our view is that most shadow AI is employees routing around slow or weak official options, so the durable fix is better sanctioned tools and plain data rules. Enforcement is for the narrow set of cases involving sensitive data, where a mistake is expensive and can't be undone.

This piece is about people using unsanctioned chatbots, assistants, and extensions with company data. If your concern is people building apps with AI, that's a different problem, covered in employees building their own apps with AI.

Key Facts

• In Microsoft and LinkedIn's 2024 Work Trend Index, a survey of 31,000 knowledge workers across 31 markets fielded in February and March 2024, 78% of AI users said they bring their own AI tools to work, and 80% at small and medium-sized companies.
• In the same survey, 52% of AI users at work were reluctant to admit using it for their most important tasks, which means usage is likely undercounted.
• IBM's 2025 Cost of a Data Breach report found that one in five organizations reported a breach due to shadow AI, and that high levels of shadow AI added about $670,000 to average breach costs.
• In the same IBM report, 63% of breached organizations had no AI governance policy or were still developing one, based on breaches at 600 organizations between March 2024 and February 2025.
• The UK's National Cyber Security Centre said in September 2026 that shadow AI is unlikely to disappear completely and the goal should be to reduce risk, by giving staff approved tools that meet their needs.

Why people go around the front door

The popular framing is that employees are careless. The evidence points somewhere less comfortable for management.

Microsoft's survey linked the behavior to the working conditions around it. The report notes that work has accelerated faster than employees' ability to keep up, with 68% of respondents saying they struggle with the pace and volume of work. It also observed that without guidance or clearance from the top, employees are taking things into their own hands. People under pressure grab the tool that works.

The NCSC reached the same conclusion from the security side. Its September 2026 briefing says organizations' policies have not always developed at the same pace as the technology, so employees turn to tools that haven't been approved. Where security policies can't meet business needs, it expects staff to keep adopting new AI services before the organization has had time to assess them or provide approved alternatives. That's a government cyber agency describing shadow AI as a gap in supply, not a gap in character.

In practice, the gap usually takes one of four forms:

• The approved tool is slower. Requests go through a queue, so the free tool wins on Tuesday afternoon.
• The approved tool is weaker. It does a narrow job, and people need a general one.
• The approved tool doesn't exist. Leadership said "be careful with AI" and stopped there.
• The rules are unclear. People don't know what counts as sensitive, so they guess, and the safe guess feels like a refusal.

Every one of those is a management decision, not an employee failing. If you want to know whether your approved options are the problem, ask the people using the unapproved ones. They'll tell you in about ten minutes.

The part that really is a security problem

None of this means shadow AI is harmless. The IBM figures are worth taking seriously, with the caveat that they come from a breach study of organizations that already had incidents. Shadow AI there showed up in one in five breach reports, and incidents involving it exposed personally identifiable information more often than the global average (65% versus 53%) and intellectual property more often too (40% versus 33%). The same source ties that to a lack of policy: 63% of breached organizations had none, or were still drafting one.

The mechanism is simple. The NCSC explains that information sent to consumer AI services may be stored, retained or used to improve the service, outside your security and governance arrangements, unless specific privacy controls are in place. Once it's there, you've lost visibility and control.

The best-known illustration is still Samsung in 2023. Reporting on an internal memo described semiconductor engineers who had been allowed to use ChatGPT to fix source-code problems and who entered confidential material, including source code and internal meeting notes. Samsung responded by restricting generative AI on company devices while it prepared security measures. Notice the sequence: the engineers had a real job to do, and the response was to restrict the tool, which is the move that tends to push people toward personal devices.

So the honest answer to our headline question is: it's a security problem because it's a supply problem. You can't fix the first without fixing the second.

Match the response to the data, not to the tool

A blanket ban treats a marketer drafting a LinkedIn post and an engineer pasting a customer database in the same way. They aren't the same risk. The more useful question is what data is in play, and what you do about each tier.

The table below is a framework, not a standard. Adjust the tiers to your industry and your regulators.

Two things follow from the table. First, most shadow AI activity sits in the top two rows, where the right response is to make the sanctioned path easier than the unsanctioned one. Second, the enforcement budget, meaning the monitoring, the blocking, and the awkward conversations, belongs in row four. If you spread it across everything, you'll lose goodwill in the cheap cases and still miss the expensive ones.

An illustrative example

Take a hypothetical 200-person software company. Leadership bans all outside AI tools after a scare. Within a month, a survey shows usage hasn't dropped; it's gone to personal phones and home laptops. The company then does three things instead:

1. Buys an approved assistant with enterprise data terms and rolls it out to everyone in a week.
2. Publishes a one-page rule: public and internal material is fine in the approved tool, customer data needs a named workflow, and source code and HR records never go into any outside tool.
3. Blocks the top unapproved assistants only for the engineering and HR groups.

The numbers here are invented, but the structure is the point. The company moved most people from forbidden to supported, and spent its enforcement effort on the groups that touch the data that matters. Compare that with the original ban, which gave up visibility without reducing risk.

What the approved toolset has to do to win

Replacing a free tool people already like is harder than it sounds. A sanctioned option has to beat the shadow one on the things employees actually care about.

Speed to access. If getting a license takes weeks, you've guaranteed the workaround. Measure the time from request to usable tool.

Capability on real tasks. Test the approved tool on the five jobs people are routing around it for. If it can't do them, you haven't yet offered an alternative. This is also where the verification tax bites: a tool whose output takes longer to check than to write yourself will lose to anything else.

A clear yes. People need to know what's allowed without reading a policy. A list of approved tools plus a one-line rule per data tier is enough. For smaller firms, how much AI governance a small company actually needs is a useful scale check, and the governance gap explains why policies that nobody can apply fail.

A way to ask. Give people a place to request a tool and get a real answer within days. The NCSC's advice is to encourage open communication so staff are less likely to turn to shadow IT, because organizations that understand why people use shadow AI are better placed to identify risk and provide secure alternatives.

Reading shadow AI as a signal

There's a useful way to flip the problem. Every unapproved tool in use is a data point about unmet demand. If twenty people in finance use the same outside assistant, that's a requirement document you didn't have to commission. Cluster what you find by job to be done, not by app name, and you'll see which approved capabilities are missing. A shopping list for small-company AI strategy is a reasonable place to start sorting those needs into buy, build, and skip.

And remember that the usage you can see is probably the smaller number. With 52% of AI users in Microsoft's survey reluctant to admit using it on their most important tasks, a punitive posture teaches people to hide, which makes your visibility worse exactly when you need it.

What to Do Next

For a CEO, COO, CIO, or CISO, this fits in a quarter.

1. Find out what's actually in use. Run an anonymous survey and a review of network or browser-extension logs. Promise no penalties for what comes out of the survey. You want an honest picture, not a clean one.
2. Cluster by job, not by tool. Group the findings into the tasks people are doing. These are your unmet needs.
3. Classify your data in four tiers. Public, internal, confidential, and restricted is enough. Write one sentence on what each tier may be used for with AI.
4. Ship a sanctioned option fast. Pick an approved assistant that handles the top tasks, with enterprise data terms, and measure time-to-access in days. Compare its performance on the real jobs, not on a demo.
5. Publish the rules on one page. Enable the low tiers explicitly. Channel the middle. Name the restricted tier and the consequences.
6. Enforce on the restricted tier only. Block unapproved tools where source code, regulated data, or HR and health records live. Keep monitoring proportionate everywhere else.
7. Review quarterly. Models and tools change quickly, and so does demand. Re-run the survey, retire tools nobody uses, and approve the ones people keep asking for.

If you do nothing else, do step one. You can't govern what you haven't looked at, and the NCSC's own summary is blunt about it: you cannot manage what you do not know.

Learn More

• Employees Building Their Own Apps With AI: Empowerment or the Next Shadow IT?
• The Governance Gap: What Leaders Get Wrong About AI at Work
• AI Agent Security Questions for Leaders
• The Verification Tax: Why AI Time Savings Shrink Once Someone Checks the Work
• AI Security and Compliance