Shadow AI (“The AI You Didn’t Approve Is Already Running Through Your Business”)

You may have heard the term “shadow IT”, which is when people use software that is not known (or approved) by the “official” IT department.  Now there’s a name for quietly using an AI tool nobody signed off on - “shadow AI”.

What’s actually happening

Verizon’s 2026 Data Breach Investigations Report found that 45% of employees now regularly use AI tools on their work devices. A year ago, that number was 15%. That kind of increase changes the problem, not just its size.

Most of them aren’t even going through a company account. Verizon found about two-thirds of people reaching these tools are doing it through personal logins on a work laptop, which means there’s no visibility into what’s going in or coming out. Shadow AI is now the third most common way sensitive company information leaves a business without anyone deciding it should — a fourfold jump from the year before. The single most common thing people are pasting in? Source code. Internal documents and research files show up too.

None of this is really a sabotage story. Most of it is people trying to get through their day faster, using whatever’s open in another tab.

Why this actually matters

IBM’s 2025 Cost of a Data Breach report put a number on it. Companies where shadow AI was common paid about $670,000 more per breach than companies where it was rare — and those breaches are more likely to involve both customer data and company intellectual property walking out the door.

The uncomfortable part isn’t that employees are using AI. It’s that most businesses, including plenty that would tell you they have decent security, have no idea which tools are actually in use or what’s being typed into them. You can’t manage a risk you haven’t admitted exists.

What to do about it

I’m not going to tell you to ban ChatGPT, Claude or other AI tools company-wide — in my experience that mostly just pushes it further underground, and you lose any say in how it gets used. A better starting point is smaller and more honest: ask your team, directly, what AI tools they’re already using to get work done. Not as a trap, as a real question. You’ll learn more in a constructive conversation than from any policy memo.

From there, the fix isn’t complicated: pick one or two approved tools with a business-grade account, so at least the data stays inside something your company controls. Say plainly what’s off-limits — client data, financial records, anything with someone else’s personal information in it — and write the policy down as a part of your company’s security policy.

The bottom line

It is clear that AI is here to stay, and that you really do want your team using the tools available to make their work better and faster.  Starting with a policy of approved AI tools is a good first step.  Make sure the next step is educating everyone on how to securely use the tools.

Next, consider implementing a security tool to monitor which tools are being used in your environment so you can “trust but verify” that your policy is working.

If you’re a client of Revolution Group, AI security monitoring is exactly the kind of thing we can help you implement to make sure your AI security policy is successful.

— Rick