Shadow AI

Shadow AI is the use of AI tools your organization has not sanctioned, usually through personal accounts and personal payment methods. It is normally framed as a discipline problem. It is better understood as a routing problem: demand exists, the sanctioned path is missing or slow, so the demand finds another path.

The numbers, with sources

Cisco’s 2024 Data Privacy Benchmark Study, a double-blind survey of 2,600 privacy and security professionals across 12 geographies, reported that 48 percent of organizations admitted entering non-public company information into generative AI tools, and that 27 percent had banned the tools at least temporarily over privacy and security concerns. The same study found 63 percent had established limits on what data can be entered and 61 percent had limits on which tools can be used.

Read those together and the picture is clear enough. Roughly half of organizations know non-public information has gone into these tools, a quarter responded with a ban, and most of the rest responded with a rule. Neither response addresses why it happened.

A ban is worth being precise about: it moves the activity rather than stopping it. The work still needs doing, the tool is still one browser tab away, and the only thing that reliably changes is that people stop telling you.

Source: Cisco 2024 Data Privacy Benchmark Study and the accompanying release.

Discovery, in rough order of effort

Expense reports. The highest-yield and least technical source. Personal-card reimbursements for AI subscriptions tell you exactly which tools, which teams, and how long it has been going on. Start here.

SSO and OAuth grants. Any tool someone authorised against a corporate identity is visible in your identity provider’s application list, including ones nobody approved. Review it; the list is usually longer than expected.

Network and DNS telemetry. Traffic to known AI provider domains from corporate devices. Blunt and only covers managed devices on managed networks, but it establishes scale.

Browser extension inventory. Frequently the least governed software in the estate, often with permission to read every page the user opens.

Asking. An amnesty produces better data than any of the above, and only works once, so spend it well. Make it explicitly non-punitive, ask what they were trying to do, and publish what you build in response.

The response that works

Discovery is the easy half. What you do next determines whether it recurs.

1. Find out what they were trying to do. Every shadow tool is a task the sanctioned path did not cover. That list is your roadmap.
2. Ship a sanctioned path for the common cases, quickly, even if it is worse than the tool they found. It has to be close enough that the difference is not worth the risk.
3. Migrate the accounts rather than deleting them, and take the data with you. Deleting an account someone depends on without a replacement teaches them to hide the next one.
4. Then close the unsanctioned path, once the alternative is real.

Reversing steps two and four is the common mistake, and it is why the second wave of shadow AI is always harder to find than the first.

Personal accounts are the durable risk

A tool bought on a corporate card is at least an asset. A tool on a personal account is not: your organization’s data sits in an account you do not control, held by a person who may leave, under terms nobody read, with a password you cannot rotate and no way to export.

When that person leaves, the data leaves with them, and there is no offboarding step that touches it. That is the risk worth prioritising, ahead of the tool choice itself.