AI 101 — What is shadow AI?
Shadow AI is the artificial intelligence an organization is running without having approved it — a personal chatbot account on a work laptop, an app nobody registered, a feature that quietly appeared inside software the company already bought — and it stays invisible by construction, because the whole point is that nobody asked. The UK's National Cyber Security Centre, which published guidance on the problem in September, defines it as "the use of AI technology which isn't captured in an organisation's approved systems and processes." It is shadow IT's younger, faster-moving sibling, with one important difference: the risk does not sit in the app somebody installed. It sits in the text and files somebody pasted into it.
Why it matters right now
The bill is arriving. IBM's 2026 Cost of a Data Breach report, built on 602 breaches between March 2025 and February 2026, found shadow AI figured in 43 percent of them, more than double the 20 percent a year earlier, and those incidents cost $5.39 million on average against $4.63 million the year before, according to the report. In about one in five, the organization also paid a regulatory fine.
The scale explains the bill. Gartner's survey of 12,004 employees and managers across 40 countries found that 88 percent of people with access to company AI also use personal AI tools for work tasks, the firm reported in May. Gartner's Diana Sanchez put the reason plainly: employees do it "often to save time." The same research found those hybrid users are 1.7 times more likely than enterprise-only users to report significant time saved. That is not defiance. It is a tool that works better than the one they were given.
The security industry has responded faster than most categories manage. This year alone, CrowdStrike shipped an endpoint control plane that inventories unapproved AI agents, Dataiku launched a cross-vendor agent inventory, and Broadcom moved the same hunt into the network itself — Broadcom wants to catch shadow AI in the packet path. When three vendors build detection for the same thing in one quarter, the thing is no longer fringe.
The mental model: four doors, not one
Most people picture shadow AI as one employee with one personal ChatGPT tab. There are at least four ways AI enters a company unapproved, and they need different fixes.
The personal account on an approved tool. The company bought 500 seats of an enterprise chatbot; the employee keeps logging into the free version with a personal login, because it remembers their history. The domain is on the allowlist, so the network sees nothing unusual. Only the account differs, and the account is exactly what a domain block cannot see.
The unapproved app. A transcription tool, a PDF summarizer, a resume polisher, a free image generator. Some are excellent. Some store what you upload and train on it. Nobody in legal has read the terms.
The feature inside software you already bought. Your customer-support platform, your CRM, your code host all added AI over the past two years. The security review that cleared those platforms happened before the features existed, so the AI half has never been assessed by anyone.
The agent. An autonomous system that acts — books, files, queries, posts — built by someone in a business unit on a low-code platform, with credentials and no inventory entry. This is the fastest-growing door and the one with the widest blast radius, because an agent inherits every permission its builder had.
The kitchen analogy
Picture an office with a fitted kitchen: one oven, one fridge, all of it inspected, insured and on the building's electrical plan. Now imagine staff bringing in their own air fryers and a small deep fryer, because the oven takes forty minutes to warm up and lunch is twenty-five.
Nobody did anything wrong, and the food got made faster. But the wiring was sized for the oven, the fire inspection never saw the deep fryer, and if something burns, the first question is "what else is plugged in?" — which nobody can answer, because there is no register of appliances. That is the whole governance problem: not "should staff cook?" They will. "What is plugged in, and what is it touching?"
Common misconceptions
"It is just ChatGPT in a personal tab." That is the biggest single category, and the easiest to picture, but the healthiest organizations find the problem in the boring places: a summarizer embedded in a ticketing tool, an agent a sales team built to rank accounts, a contractor's app that happens to be public. The 94.7 percent of Grok Build apps we covered last week that opened for anyone with no sign-in is what the fourth door looks like once it is left ajar.
"Block the domain and it stops." Both the corporate and personal versions of a major chatbot live on the same domain, so a block hits the paid, governed account and the free, ungoverned one identically. Employees who have already decided the tool is necessary route around the block from a phone. The behaviour moves; it does not end.
"It is a policy problem, so legal owns it." IBM found 68 percent of breached organizations had no AI governance in place to manage AI use or detect shadow AI. Policy is the cheapest control and the least effective one on its own, because a rule cannot see a prompt.
"Only junior staff do this." The pattern follows incentive, not seniority: whoever has the most repetitive text work and the least patience for procurement. Gartner's finding that hybrid users save more time is the honest explanation, and it is why a ban reads to them as a pay cut.
"Shadow AI is shadow IT with a new name." Shadow IT discovery asks "what app did someone install?" Shadow AI asks "what did they paste, and where did it go?" The app may be one the company already approved.
Where to learn more
Start with the NCSC's write-up, which is short, non-alarmist and aimed at the person writing the policy rather than the person selling the fix. IBM's report is the best public data on what this costs.
The practical controls are unglamorous: an inventory of what is in use, guardrails around what an agent may touch, and a sanctioned tool good enough that the personal account stops being worth the trouble. For the mechanics of that first and second item, What is an AI guardrail? covers the checks around a model, and What is prompt injection? explains why text pasted into an unvetted tool is an attack surface and not just a data leak.
Does your workplace have an AI inventory, or is everyone quietly using their own accounts? Write to us via our contact page.
Related reading:
