Most owners are still deciding whether to adopt artificial intelligence. Their employees decided months ago.
That gap has a name. Shadow AI is the use of artificial intelligence tools inside a company without approval, oversight or visibility from the people accountable for its data. It is not a hypothetical exposure waiting for your industry to catch up. It is running in your business today, and the only real question is how much of it you can see.
How widespread it actually is
The numbers are consistent across independent studies, which is unusual in this field and worth paying attention to.
WatchGuard’s 2026 Cybersecurity Hygiene Report, published in July 2026 and drawn from 684 employees at companies with 50 to 500 people, found that 64% admit to using unauthorized AI tools for work. The same survey found that fewer than 30 % of employees believe their organization maintains an accurate software inventory, and nearly 40 % say their company lacks full visibility into the applications in use.
Vanta, analyzing anonymized data from more than 15,000 businesses, reported in July 2026 that 70 % of companies have shadow AI in their environment, with an average of around 140 unapproved tools discovered within 90 days of looking. When those tools were revoked, employees reinstalled them more than 100 times a month.
Browser telemetry from LayerX, published in October 2025, adds the detail that matters most. 77 % of employees paste data into generative AI prompts, and 82 % of those pastes come from unmanaged personal accounts. Roughly 40 % of files uploaded to these tools contained sensitive personal or payment data. Generative AI now accounts for around 32% of all corporate-to-personal data movement, making it the leading data exfiltration channel in the enterprise.
Netskope’s January 2026 Cloud and Threat Report found the average organization now uses eight generative AI applications, up a third year over year, and records an average of 223 generative AI data policy violations per organization per month, driven by roughly 3 % of AI users.
This is not a discipline problem
The instinct is to read those numbers as a compliance failure. That reading leads to the wrong fix.
Research published by BlackFog in January 2026, surveying 2,000 workers, found that 63 % consider unapproved AI acceptable specifically when no corporate option exists, and that 58 % of those using unsanctioned tools use the free version. The same study found that 6 9% of presidents and C-suite executives, and 66 % of directors and senior vice presidents, considered shadow AI acceptable. Leadership is not the exception to the pattern. It is the largest single contributor to it.
Put plainly: your team is under the same workload as last year, a tool exists that removes an hour from their day, it is free, and signing up takes a minute. No policy written in a shared drive competes with that.
Where the actual risk sits
Shadow AI is not dangerous because AI is dangerous. It is dangerous because of the account it runs on.
Consumer tiers carry different terms. Enterprise and business tiers from the major providers now carry explicit contractual commitments. OpenAI’s enterprise privacy documentation states that customer data is not used to train models by default across its Business, Enterprise, Edu and API tiers, backed by SOC 2 Type 2, a GDPR data processing agreement, administrator-controlled retention and audit logging. Microsoft’s enterprise data protection commitment for Microsoft 365 Copilot states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. Those protections attach to the contract, not to the technology. A free personal account is outside them.
You lose the record. When an employee uses a personal account, there is no log you can query, no export you can produce during an incident investigation, and no way to answer a client or an auditor asking what left your environment. IBM’s Cost of a Data Breach Report 2025 found that breaches at organizations with high levels of shadow AI cost an average of 670,000 dollars more than the global average of 4.44 million. The premium is not the tool. It is the length and breadth of an investigation where nobody can say what went where. The same report found that one in five organizations reported a breach connected to shadow AI, and that 63 % of breached organizations either have no AI governance policy or are still writing one. Among those that do have a policy, only 34 % perform regular audits for unsanctioned AI use.
The data classes are worse. IBM found that shadow AI breaches exposed personally identifiable information in 65 % of cases and intellectual property in 40 %, against global averages of 53 and 33 %. These are the incidents that generate notification obligations and contract disputes.
The provider inherits your risk. In January 2025, Wiz Research discovered a publicly accessible DeepSeek database with no authentication, exposing more than a million log entries including user chat histories and plaintext API keys. Every organization whose employees had used the free tool had, without knowing it, adopted that provider’s security posture as their own.
The canonical case remains Samsung, which in April 2023 discovered that engineers had pasted confidential semiconductor material into ChatGPT. Samsung banned generative AI tools on company devices weeks later. The lesson was never that the engineers were careless. It was that a capable, free tool with no sanctioned equivalent will be used.
Sanctioned AI is not automatically safe either
It is worth saying so plainly, because it changes what “governance” means.
In June 2025, researchers at Aim Security disclosed EchoLeak (CVE-2025-32711), a zero-click prompt injection chain in Microsoft 365 Copilot that allowed an attacker to exfiltrate organizational data Copilot could access without any user interaction. Microsoft patched it. The point stands: moving people onto approved tools reduces the contractual and visibility risk substantially, and does not remove the need for least privilege, logging and monitoring.
Guidance published on April 30, 2026 by CISA, the NSA and their partner agencies in Australia, Canada, New Zealand and the United Kingdom, covering the adoption of agentic AI services, makes the same point in operational terms. Its core recommendations are to never grant AI broad or unrestricted access to sensitive data or critical systems, to start with low-risk non-sensitive tasks and increase access progressively, to restrict tools to an approved allow list that is verified regularly, to apply least privilege, and to maintain comprehensive logs and real-time monitoring.
Why banning it does not work
Three reasons, all measurable.
The tools are too numerous to blocklist. Netskope tracks over 1,550 distinct generative AI software-as-a-service applications. A blocklist is out of date the week you write it.
The device is not yours. If the desktop blocks it, the work moves to a phone, and you lose the last thread of visibility you had.
And revocation without a replacement produces reinstallation, at a documented rate of more than a hundred times a month in Vanta’s dataset.
There is one data point that should reframe the whole conversation. Netskope found that in organizations that applied governance, the share of AI users on personal accounts fell from 78 % to 47 %, while organization-managed account use rose from 25 to 62 %. Governance works. Prohibition is not governance.
A practical plan for a small business
Six steps, in the order that actually holds.
1. Discover what is already running
Start with evidence, not a survey. Employees under-report, and not out of dishonesty. They do not think of a browser extension as a tool.
If you are a Microsoft 365 business, know this: the Copilot usage report in the Microsoft 365 admin center will not show you non-Microsoft AI usage. It reports Copilot telemetry only. Seeing shadow AI requires different tooling. Microsoft Defender for Cloud Apps includes a dedicated Generative AI category in its Cloud App Catalog with per-application risk scores and sanctioned or unsanctioned tagging. Microsoft Entra Global Secure Access added shadow AI discovery that identifies AI chatbots, model provider APIs and AI code generators from network traffic, showing which users accessed which application, how often, and how many bytes were sent. Microsoft Purview Data Security Posture Management for AI surfaces user interactions with AI applications and can detect sensitive information pasted or uploaded to AI sites.
Expect the number to be higher than anyone predicted. That is normal, and it is the useful part.
2. Give people a sanctioned tool on a business tier
This is the single highest-leverage move, because 63 % of unapproved use is explained by the absence of an approved alternative. A business or enterprise tier of a mainstream assistant, purchased and administered by you, moves most of your usage inside your contract, your single sign-on and your audit log in the space of a week.
3. Move users off personal accounts
Federate the sanctioned tool through your identity provider. This is what converts “we bought licenses” into “we can see what happens.” LayerX’s finding that 82 % of sensitive pastes originate from personal accounts is the whole argument.
4. Write one page
Not a policy document. One page, covering four things:
- which tools are approved, and for what
- what data must never be entered into any AI tool, named specifically for your business: client lists, contracts, unreleased financials, personal data, credentials, source code
- what requires a human review before it goes to a client
- who to ask when someone wants to use something new, and a commitment to answer within a set time
The last line is the one that determines whether the page works. If the answer to “can I use this” takes three weeks, people stop asking.
5. Put data loss prevention on the paste path
The exfiltration channel has moved. It is no longer primarily email attachments and file shares. It is the browser clipboard. Endpoint and browser-level data loss prevention rules that detect sensitive data being pasted or uploaded to AI sites are now the control that matches the behavior.
6. Log, retain and audit
Keep prompt and response records where the platform supports it, and schedule a quarterly review of what is in use. Only 34 % of organizations with an AI policy audit for unsanctioned tools. Being in that third costs very little and is the difference between a policy and a claim.
What good looks like in six months
You have a list of the AI tools genuinely in use, refreshed monthly rather than annually. Most usage runs through business-tier accounts tied to your identity provider. Your team knows the three categories of data that never go into a prompt, because it is written down in language about your business rather than about compliance. New tools get requested and approved or declined in days. And if a client or an insurer asks how you govern AI, you have an answer that takes one page and survives a follow-up question.
None of that requires slowing your business down. It requires knowing what is already happening in it.
Where Alchanis fits
Alchanis Technical Services is a veteran-owned managed security provider working with small and mid-size businesses across the United States. We run AI discovery against live environments, tell owners plainly what is in use and what it exposes, and put the governance in place without turning the business into a place where nobody can get anything done.
If you would like to know what is actually running in your environment, we are at alchanistech.com.
