What counts as shadow AI
The canonical case is an employee pasting sensitive data into ChatGPT from a personal account, but that is only the visible layer. The 2024 Microsoft and LinkedIn Work Trend Index reported that 78% of AI users brought their own AI to work, and 71% of office workers admitted using AI tools without IT approval [2]. In every AI inventory exercise, three categories consistently surface, and each requires a different remediation path.
- Personal-account use of consumer AI services (ChatGPT, Claude, Gemini, Perplexity) with corporate data. Surfaces from DLP alerts and, occasionally, an amnesty program.
- SaaS tools that quietly added generative features in a recent release: Notion AI, Slack AI, Zoom AI Companion, Salesforce Einstein GPT, and dozens of smaller tools. Surfaces from procurement and SSO logs.
- Team-built integrations: a marketing analyst wiring OpenAI into a Google Sheet, a data engineer running a local llama.cpp on production data, an acquired subsidiary running its own models. Surfaces only from network telemetry and conversations.
Why it is not just shadow IT
Shadow IT is an access-control problem: someone is using a tool without approval. Shadow AI adds two complications that make it materially harder. First, the data leaves: any conversation with an external model potentially trains on, caches, or logs the content you sent, depending on the provider's terms and your account tier. Second, the output comes back: an employee who drafts a contract clause in an unapproved model then pastes that clause into a real document, and nobody knows which clauses were machine-written.
That dual flow (data out, output in) is the part that breaks simple blocking strategies. Samsung's 2023 company-wide ChatGPT ban did not stop AI adoption; it pushed it underground and made the governance problem worse [3]. The working approach is visibility first, policy second. IBM's 2025 data-breach report found that 97% of organizations with shadow-AI-linked breaches lacked proper AI access controls [1].
How to surface it
- 01
Start with SSO logs
Enumerate every SaaS tool in the corporate identity catalog that has added a generative feature. The top 200 tools will cover the bulk of the exposure. This is a one-afternoon exercise that most organizations have never run.
- 02
Cross-reference procurement records
Search the last 24 months of procurement and expense data for strings like "AI", "copilot", "agent", "assistant", "LLM", and "GPT". Each hit is a candidate for the inventory.
- 03
Review DLP egress telemetry
Most enterprise DLP platforms now flag traffic to consumer AI services. Turn on the category and measure for 30 days. The volume is rarely what leadership expects.
- 04
Run a one-week amnesty
Ask employees to register the AI tools they actually use, without punishment. You will learn more in a week than in a quarter of top-down discovery.
- 05
Refresh monthly, not annually
Shadow AI inventories decay. The annual governance refresh is theatre; monthly is the lowest cadence that survives contact with reality.
What a governance response looks like
Ban-everything approaches fail. Unregulated-everything approaches fail. The governance pattern that works, in practice, has three parts: provide a sanctioned alternative (usually an enterprise LLM with DLP, logging, and retention controls) so employees have a legitimate path; publish a plain-language use policy describing what data can and cannot leave the sanctioned alternative; and monitor for drift with the inventory process above.
Jarvis, like every serious enterprise LLM platform, exists partly to make the sanctioned-alternative story credible: DLP, RBAC, audit logs, and multi-model routing in one layer. That is not the point of this entry; we mention it only because we would be dishonest if we pretended the sanctioned-alternative slot was filled by a competitor on this site.
Shadow AI, the common questions
-
What is shadow AI?
The use of AI tools outside the visibility and control of IT, security, and governance. Consumer services: ChatGPT, Claude, Gemini, Perplexity. SaaS-embedded AI features. Team-built integrations a data engineer wired up on a Tuesday. Shadow IT, with two extra problems nobody budgeted for. The data leaves the organization (to provider servers, caches, or training sets). The machine-generated output returns into real documents with no audit trail. Both directions are a problem; the second one is the one that bites quietly. -
How costly is shadow AI?
Costly enough to change the conversation. IBM's 2025 Cost of a Data Breach Report put the average shadow-AI breach at $4.63 million. That's $670,000 above a standard incident. One in five organizations (20%) reported a shadow-AI-linked breach. Of those, 97% lacked proper AI access controls. The exposure skewed toward customer PII and intellectual property, which are the two categories that turn a breach into a regulator conversation. -
How widespread is shadow AI?
Widespread enough that "surface area" is the wrong question. The 2024 Microsoft and LinkedIn Work Trend Index put 78% of AI users bringing their own AI to work. 71% of office workers admitted to using AI tools without IT approval. More recent 2025 data pegs shadow-AI usage at around 37% of staff as a persistent corporate-security concern. Which means any governance program that assumes employees will wait for a sanctioned alternative is already six months behind. -
Can I just block ChatGPT to stop shadow AI?
No. Samsung tried a company-wide ChatGPT ban in 2023. The ban did not stop adoption. It pushed it onto personal devices, where DLP could not see any of it. The pattern that works in 2026 has three moves. Provide a sanctioned enterprise alternative (ChatGPT Enterprise, Microsoft Copilot, or an internal LLM platform). Publish a plain-language use policy people will actually read. Monitor for drift on the same cadence as patch compliance. Banning without an alternative is the shortest path to losing visibility entirely. -
How do I surface shadow AI in my organization?
Five steps, in order. Start with SSO logs; the top 200 SaaS tools cover most of the exposure. Cross-reference the last 24 months of procurement records for strings like 'AI', 'copilot', 'agent', 'assistant', 'LLM', 'GPT'. Turn on DLP egress telemetry to consumer AI services and measure for 30 days. Run a one-week amnesty where employees register what they actually use, no punishment. Then refresh monthly, not annually. Annual discovery is theatre; monthly is the lowest cadence that survives contact with reality. -
What tools help detect shadow AI?
Several, each solving a different slice. Microsoft Purview AI Hub is the most mature option for Microsoft 365 environments. Cloudflare Gateway's shadow-MCP scans, rolled out in 2026, extend detection to MCP servers specifically. Nudge Security. Torii. Vectra. Proofpoint. Each publishes shadow-AI-specific detection features, and the right answer is usually two of them, not one; the overlap is how you catch the thing the primary tool misses.