Shadow AI Is Already in Your Organisation. The Question Is Whether You Can See It.

Shadow AI, the use of unsanctioned AI tools by staff without IT approval, is already present in most large organisations, and the real question for security leaders is not whether to allow it but whether they can even see it. Surveys through 2026 put the share of employees using unauthorised AI tools somewhere between 60 and 90 percent depending on definition, while only around 18 percent of organisations report having a formal AI security policy (Airia). That gap, between what staff are doing and what the organisation has governed, is where the risk lives.

Why this is a security problem, not just a policy gap

The headline concern with shadow AI is data leakage. When an employee pastes a customer list, a contract, source code or a strategy document into a public generative AI tool to get help with it, that data has left the organisation’s control and entered a system it cannot audit, retain or delete. Multiply that by most of the workforce, several times a day, and the exposure is significant.

The incident data bears this out. IBM’s breach research has found that unsanctioned AI tools now feature in a large share of security incidents, a figure that more than doubled in a single year, and that shadow AI adds materially to the cost of a breach when it is involved (reported analysis). The volume of data flowing to these tools is climbing just as fast. Netskope’s 2026 Cloud and Threat Report found that data sent to generative AI apps in the median organisation grew roughly sixfold in a year (Netskope, via industry reporting). This is not a theoretical risk building slowly. It is a live one, growing quickly.

Shadow AI is the natural successor to shadow IT, and it spreads faster. Adopting an unsanctioned SaaS application at least required signing up for a service. Using an unsanctioned AI tool can be as simple as opening a browser tab and pasting. The friction that once slowed shadow IT barely exists here.

Why banning it does not work

The instinctive response, to block the tools at the firewall, is understandable and largely ineffective. The demand is real, because these tools genuinely help people do their work faster, and blocked staff simply route around the control. They use personal devices, personal accounts and home networks, which moves the activity from something the organisation could at least partly see to something entirely invisible. A ban does not remove the risk. It removes your visibility of it.

A ban does not stop shadow AI. It just relocates it to devices and accounts you cannot see, which is worse.

The more effective posture treats the demand as legitimate and channels it safely, rather than trying to suppress it. If staff have a sanctioned, capable AI tool that is safe to use, most will use it rather than resort to an unapproved one. The goal is to make the safe path the easy path.

Sectors where the stakes are highest

The exposure is not evenly distributed. In financial services, a large majority of employees report using at least one unsanctioned AI tool, in an industry carrying among the highest regulatory risk for unauthorised data processing. In healthcare, patient data shows up in a meaningful share of AI data events, in an environment where privacy penalties are severe. For regulated Australian organisations and government bodies, shadow AI is not only a data risk but a compliance one, because sensitive or personal information entering an ungoverned tool can breach obligations the organisation is legally bound to uphold.

What CISOs and technology leaders should do

Managing shadow AI is less about a single tool and more about closing the gap between usage and governance.

1. Discover what is actually in use. Get real visibility of which AI tools staff are using and for what, because almost every security team underestimates it. You cannot manage what you cannot see.
2. Provide sanctioned alternatives. Give people capable, approved AI tools that are safe to use, so the safe option is also the convenient one.
3. Apply data controls. Use data loss prevention and monitoring to catch sensitive information heading into unapproved tools, and to enforce boundaries on the approved ones.
4. Set a clear, usable policy. Tell staff plainly what they can and cannot put into AI tools, in language they will actually follow, rather than a blanket prohibition they will ignore.
5. Educate continuously. Most data leakage through shadow AI is not malicious, it is people trying to do their jobs. Helping them understand the risk changes behaviour more than blocking does.

Done together, these turn shadow AI from an invisible, growing liability into a managed, visible part of how the organisation works.

Where Jaykan fits

Jaykan helps enterprises and government organisations bring shadow AI into the light, combining discovery and data loss controls with the cyber security monitoring and governance needed to let people use AI safely rather than secretly. We help clients provide sanctioned tools and clear guardrails, so the productivity gains of AI do not come at the cost of a breach.

If you are not confident you know how AI is really being used across your organisation, a complimentary, senior led assessment will show you where your data is going and give you a practical plan to bring it under control.

Frequently asked questions

What is shadow AI?

Shadow AI is the use of artificial intelligence tools, typically public generative AI apps, by employees without the knowledge or approval of the IT or security team. Like shadow IT before it, it happens because staff find the tools useful and adopt them faster than the organisation can govern them.

Why is shadow AI a security risk?

The main risk is data leakage. Employees paste sensitive information, customer data, source code, contracts or strategy, into public AI tools that the organisation does not control and cannot audit. Unsanctioned AI tools now appear in a large and rising share of security incidents.

Should we just ban AI tools?

Banning rarely works. The demand is genuine and staff route around blocks using personal devices and accounts, which pushes the activity further out of view. A more effective approach is to provide sanctioned, governed AI tools so people have a safe option, alongside monitoring and clear policy.

What is the first step to managing shadow AI?

Discovery. You need visibility of which AI tools are actually being used across the organisation and for what, because most security teams significantly underestimate it. From there you can provide approved alternatives, apply data controls, and set a realistic policy.