Shadow AI: How Security Teams Find It and Write a Policy People Follow

TL;DR: Security teams find shadow artificial intelligence (AI) by layering network logs, software-as-a-service (SaaS) discovery, browser inspection, account checks and anonymous staff surveys, since each method misses something. A policy people follow pairs every restriction with an approved tool and training, applies the same rules to executives and is enforced consistently. In our reading, blanket bans push use onto personal accounts and devices. IBM research tied shadow AI to 43% of security incidents in 2026.

What are the risks of unapproved AI tools?

Shadow AI is staff use of AI tools, personal accounts, browser extensions or AI features inside existing software that IT and security have not approved. It differs from ordinary shadow IT because the risk travels through the tool: each prompt can carry company data out, and each output can carry an unchecked answer back into a business decision.

The cost figures come from IBM's 2026 Cost of a Data Breach research, as compiled by dope.security. It found shadow AI involved in 43% of security incidents, up from 20% a year earlier. IBM also ties high shadow AI levels to an extra $670,000 in average breach cost.

In our reading, Data leakage is the most measured risk. Netskope's average organization logs 223 generative AI data policy violations a month, double the prior year, per the same compilation. Source code made up 42% of those violations, regulated data 32% and intellectual property 16%. LayerX found that 40% of files uploaded to generative AI tools contain personally identifiable information (PII) or payment card industry (PCI) data. UpGuard reported that 23% of chief information security officers (CISOs) know credentials are being shared with AI tools.

Compliance exposure follows from where that data lands. Cyberhaven found that 83.8% of enterprise data sent to AI goes to tools rated high or critical risk, according to dope.security. Governance trails behind: IBM found 63% of breached organizations had no AI governance policy in 2025, and more than two-thirds lacked shadow AI controls in 2026. In our reading, regulated data sitting in a personal account gives the security team no retention terms, no audit trail and no deletion route to point to when a regulator or customer asks.

The attack surface widens with each unmanaged tool. In our reading, Menlo Security found 80% of generative AI access happening in the browser, a channel many network controls see only partly. The UK National Cyber Security Centre (NCSC) notes that a prompt injection can make a model reveal confidential information or trigger unintended consequences in a system that accepts unchecked input. It adds that as large language models pass data to third-party applications and services, the risk from these attacks will grow.

Accuracy is the risk that rarely shows up in a log. An unapproved tool feeding a contract summary or a code fix has no review step attached.

The policy and approval steps that answer these risks are set out in our AI governance guide for CISOs.

Why employees use AI tools their employer has not approved

Two surveys published in 2026 point to the same pattern. Unapproved artificial intelligence (AI) use is not mainly a junior-staff habit, and many of the people doing it do not treat company policy as the final word.

Senior staff use it more than their teams

A TrustedTech report found that senior decision-makers are more than twice as likely as their teams to use unapproved AI tools. The same report described a 35-point confidence gap between leaders and their teams.

PagerDuty's survey, published June 11, 2026, covered 1,250 office professionals outside information technology (IT) roles at organizations with $500 million or more in annual revenue, across four countries. It found 72% believe they know AI better than their own tech teams. Senior leaders were at 77%, against 66% for mid-level managers and below.

The same survey found 81% believe leadership operates under a different set of rules on AI. In our reading, that perception does real damage. A rule that executives are seen to skip carries little weight further down the organization.

Discipline does not settle it

TrustedTech reported that one in three employees would keep using AI even if it meant disciplinary action.

PagerDuty found two-thirds of office professionals had used AI tools at work they believed were not permitted. Among them, 53% received informal feedback to stop, and 48% faced formal consequences such as a warning or disciplinary action.

We think uneven follow-through teaches staff that the rule is negotiable. Some get a quiet word, some get a warning, and the tool use carries on.

Skills, careers and job moves

In our reading, the sharpest motive in the PagerDuty data is career growth. The survey found 77% believe their companies' restrictions limit their professional growth or career mobility, and 75% would be likely to look for a new job that offered better AI skills development. At companies with $1 billion or more in revenue, that figure climbs to 80%.

The habit often starts outside work. 89% of those who used AI for work first encountered the tool in their personal lives.

What this means for the policy

In our reading, a blanket ban now reads to many staff as a cap on their careers, so it becomes a retention question as much as a security one. Practical steps follow from that:

• Apply the same AI rules to executives and say so in writing.
• Pair any restriction with an approved tool and a training route.
• Make consequences consistent, so informal and formal responses follow a published standard.
• Bring HR into the policy, since talent loss sits alongside data loss.

For the wider governance model, see our AI governance guide for CISOs.

How do security teams find shadow AI?

Each discovery method sees one slice of AI use and misses another, so in our reading the useful approach is to layer several. Much of the activity sits in the browser: Menlo Security reported that 80% of access to generative AI sites happened in the browser in January 2025.

The scope is also wider than chat sites. Orca Security's definition covers AI-powered browser extensions, external AI APIs embedded into internal applications, and AI features in SaaS platforms that were never formally evaluated. Those are application programming interfaces (APIs) and software-as-a-service (SaaS) tools.

Accounts matter more than apps

Netskope found 47% of generative AI users still use personal AI apps at work. LayerX's browser telemetry put 67% of enterprise AI usage through unmanaged personal accounts. Netskope also saw the share of users switching between personal and company AI accounts grow from 4% to 9%.

We think this is where domain-level logs fall short. A proxy that records a visit to a chat service cannot tell you whether the login was the enterprise tenant or a personal account. That distinction decides whether the data stayed under contract.

Re-check the approved list

Orca notes that AI is increasingly embedded into SaaS platforms that were previously approved, often without teams noticing the new capability. A practical step is to add a new AI features line to each vendor's renewal or quarterly review. See our vendor pages for context on suppliers.

Blocking changes what discovery can see

UpGuard found 41% of employees work around blocked AI apps. In our reading, a block can push use onto personal devices and accounts that none of the technical methods above reach. Run discovery before you block, and keep it running afterward.

Ask, and expect undercounting

Surveys capture intent and context that logs cannot, but people hold back. KPMG and the University of Melbourne found 57% of employees hide their use of AI. Admissions still surface: the National Cybersecurity Alliance found 38% of employees admit to sharing sensitive work information with AI tools without permission. We think anonymous surveys, compared against log data, give the clearest picture of the gap. Our AI governance guide covers turning those findings into policy.

Why blanket bans push AI use out of sight

A written policy is not the same as a policy that holds. In PagerDuty's survey, 86% of respondents said they work at organizations they believe have AI policies in place. As the earlier section on motives showed, use outside policy was still common.

The same survey shows what that use carries. 88% of office professionals said they had shared work-related information with public AI tools such as ChatGPT, Claude or Gemini. Much of what they shared was not trivial:

Where the use goes when the approved route closes

A ban removes the sanctioned route. It does not remove the demand. TrustedTech describes shadow AI as employees using personal ChatGPT accounts or browser extensions to work with company data outside IT oversight. Those routes sit outside the controls a security team usually watches: single sign-on logs, the corporate tenant, data loss prevention on managed endpoints.

Palo Alto Networks makes the general point about shadow IT: employees often turn to it when sanctioned tools feel too slow, limited, or unavailable. In our reading, a blanket ban is the extreme case of unavailable. It pushes use toward the personal login and the phone in a pocket, where the team sees nothing.

The work does not move home with the account. PagerDuty found 79% use AI more often on the job than at home. The data stays work data. Only the account changes.

That is our reading of what bans do to visibility. The volume of company information entering AI tools stays roughly where it was. The share a team can log, and later investigate, falls.

Perceived fairness adds to the pressure. Employees at larger organizations were more likely (85% each) to see a double standard between leadership and everyone else. We think a rule staff believe applies unevenly is easier to ignore in private.

What to check before relying on a ban

• Whether your logs can tell a corporate AI session from a personal one on the same site.
• Whether the policy names an approved option for each common task, such as drafting email or summarizing meetings.
• Whether enforcement has been the same for senior staff as for everyone else.

For the governance structure behind these checks, see our AI governance guide for CISOs.

Questions to ask before you approve an AI tool

The National Cyber Security Centre (NCSC) wrote its secure AI guidelines for builders, but they also work as a buyer's checklist. They are aimed at providers "using models hosted by an organisation, or are using external application programming interfaces (APIs)." In our reading, that describes most tools a business unit asks to adopt, and most of the AI features that appear inside software already in use.

The stated aim gives you a simple three-part test. Each tool should function as intended, be available when needed, and work without revealing sensitive data to unauthorized parties (NCSC).

Four stages, four sets of questions

The guidelines are organized around the stages of the AI system life cycle (NCSC). Each stage below can become one block of the intake form.

The guidelines also say they follow a "secure by default" approach (NCSC). In our reading, that justifies asking which security settings ship switched on and which a customer has to find and enable.

Questions about model behavior

In our reading, the NCSC's guidance for leaders names specific weaknesses that standard software reviews miss. Each one becomes a direct question:

• Wrong answers. The model can present incorrect statements as facts. Which outputs will a person check before anyone acts on them?
• Prompt injection. An attacker writes an input designed to make the model behave in an unintended way. Can the tool read email, web pages or documents from outside, and what can it do after reading them?
• Data poisoning. An attacker tampers with training data to produce bad outcomes. Will our data be used for training, and where does the supplier's training data come from?

Who answers the form

Give the checklist to the business owner as well as the supplier. The NCSC says managers do not need to be technical experts, but "they should know enough about the potential risks from AI to be able to discuss issues with key staff."

We think a tool owner who cannot answer the design and data questions in plain words is not ready to own the tool. In that case the review is not finished, whatever the supplier's paperwork says. For how this intake fits a wider program, see our AI governance guide.

Keep the form short enough to finish in a single meeting. In our reading, a long form slows approval, and slow approval pushes people back toward the workarounds covered earlier in this guide.

What this guide does not cover

This guide does not give step-by-step configuration for specific tools. The wider governance program sits in our AI governance guide for CISOs. For the rules and the record behind it, see AI Governance for CISOs: NIST's Framework, the 12 GenAI Risks and the New Agentic AI Rules.