Empower Finds
Shadow AI: The Hidden Risks to Corporate Data
  • Topic: AI governance
  • Scope: enterprise SaaS
  • Layer: data security

Shadow AI: The Hidden Risks to Corporate Data

This article was drafted with the support of artificial intelligence tools. The data and citations were taken from the sources listed in the References section

Illustration of a laptop sending glowing data streams toward a translucent AI chip in a dimly lit office, representing unsanctioned AI tool use in companies.
Unsanctioned AI tools can move corporate data outside IT's view, making visibility and governance essential. Illustrative image.

Summary

Shadow AI is the use of artificial intelligence tools, features, or agents inside an organization without IT's knowledge, approval, or governance. Industry research published in 2026 indicates that many organizations still have limited visibility into which AI tools are used, what data is shared with them, and how that data is protected. This article explains the risks, the main identification and control challenges, and practical governance measures companies can adopt.

What Is Shadow AI?

Shadow AI refers to AI tools, features, or agents used within an organization without formal approval, oversight, or data controls. It is an evolution of shadow IT, the long-standing practice of employees adopting technology without IT involvement.

Shadow AI can take several forms:

  • Employees signing up for AI tools with personal or work accounts that IT has not reviewed.
  • Departments buying AI software-as-a-service (SaaS) applications independently.
  • AI browser extensions and AI coding assistants installed by individual users.
  • AI agents connected to business systems without a formal security review.
  • AI features that are enabled inside tools the organization already approved, often without notice to IT.

The last category is especially difficult to manage, because the tool itself was approved, while the AI functionality added later was not reviewed. BetterCloud's guide to shadow AI risk describes these forms in detail.

Diagram of shadow AI entry points A central company building sits inside a dotted IT oversight boundary. Dashed lines from outside the boundary lead to a browser, a chat bubble, a browser extension, and a personal user account. IT oversight boundary (dotted)
Common channels through which AI tools enter an organization without formal approval. Illustrative diagram.

How Large Is the Problem?

According to BetterCloud's 2026 State of SaaS report, based on a survey of 525 IT and security professionals at SaaS-first organizations:

56%of SaaS applications in use carry formal IT approval. Nearly half operate outside IT's direct oversight.
27AI-powered SaaS applications per organization on average, about 22% of the total portfolio.
21%of organizations discovered new, unsanctioned SaaS and AI tools over the previous 12 months.
41%growth in average application count among mid-market organizations in one year, from 116 to 164.

A MES Computing summary of the same findings reports the same figures. Usage-behavior studies offer complementary evidence. The LayerX Security State of AI Usage Report 2026 found that 47% of enterprise AI conversations took place through personal identities rather than corporate accounts, outside the scope of enterprise security controls. In the same analysis, more than 6% of enterprise AI conversations contained sensitive data.

Note: the LayerX figures come from a vendor's telemetry analysis, and their sample may not represent all organizations. Use them as indicators, not as universal benchmarks.

Risks of Uncontrolled AI Use

Uncontrolled AI use affects several areas at once. The main risks are summarized below.

Data exposure

When employees paste contracts, source code, customer records, financial data, or strategic plans into an unapproved AI tool, that information may be stored, processed, or used under terms the company never reviewed. BetterCloud reports that 18% of organizations experienced data leaks originating from AI tools and chatbots.

Privacy and personal data

Personal data processed by unapproved tools can create legal obligations that the organization cannot meet, such as handling data subject requests, documenting processing purposes, or reporting incidents. In Brazil, the General Personal Data Protection Law (LGPD, Law No. 13,709/2018) sets these requirements.

Security and access

Browser extensions, AI agents with broad permissions, and stale access create new paths for attackers. BetterCloud reports that 18% of organizations experienced data breaches linked to offboarded users who kept access after leaving. Shadow AI does not create this problem alone, but it increases its impact. The Akamai Enterprise AI Usage Risk Report 2026 also examines browser and IDE extensions and AI agents that operate outside existing guardrails.

Compliance

Regulations increasingly address AI use directly. The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) establishes obligations based on risk level, which can apply to organizations that operate in or serve the European Union. Companies that cannot list the AI systems in use cannot easily demonstrate compliance.

Intellectual property

Confidential product plans, unpublished code, and proprietary datasets can lose protection if they are shared with third-party services whose terms allow data retention or model training. Contract and licensing terms should be reviewed before sensitive material enters any AI tool.

Cost and governance

BetterCloud notes that nearly 40% of AI apps are billed only on usage or token consumption rather than predictable per-seat pricing. Without monitoring, costs can grow unexpectedly, which turns a governance gap into a financial one.

Financial impact of breaches

IBM and the Ponemon Institute's Cost of a Data Breach Report 2026 reports that the global average cost of a data breach reached a record high, an increase of 12% over the previous year, and links AI-driven attacks to rising incident volumes. This research does not isolate shadow AI as a cause, but it shows why unmanaged data flows matter.

AI agent passing through an access gate A glowing AI agent holding a key passes through a partially open gate and reaches a network of interconnected data nodes. Access gate · AI agent · Company data nodes
AI agents with broad or stale permissions can widen the path to sensitive systems. Illustrative image.

Why It Is Hard to Identify and Control AI Tools

  1. Visibility gaps. Many tools are accessed through web browsers or personal accounts, leaving no record in corporate systems.
  2. Embedded AI features. AI capabilities are added to approved platforms through updates, which may bypass the original review.
  3. Personal accounts. Employees may use personal identities for work tasks, as LayerX's analysis indicates.
  4. Speed of adoption. New tools can appear faster than procurement and security reviews can respond. BetterCloud's findings, as summarized by MES Computing, suggest that AI adoption is moving faster than governance in many organizations.
  5. Limited detection capability. BetterCloud notes that most organizations lack real-time discovery and automated controls for unsanctioned AI tools.
  6. Gaps in policy. Many organizations lack a comprehensive, enforced AI usage policy. In the LastPass 2026 State of AI and SaaS Security Report, 73% of organizations reported lacking one.

Employees rarely act out of bad intent. Often they are trying to work faster. For this reason, controls that rely only on prohibition tend to fail.

Recommended Governance Practices

The following measures are general good practices, consistent with frameworks such as the NIST AI Risk Management Framework.

  1. Inventory AI tools and features. Combine SaaS discovery, identity logs, and browser or endpoint data to identify tools in use, including embedded AI features.
  2. Create a clear AI acceptable-use policy. Define approved tools, prohibited data types (for example, customer personal data or source code), and the approval process for new tools.
  3. Provide approved alternatives. Offer enterprise AI tools with business-grade data terms so employees have a secure option that meets their needs.
  4. Classify data and apply controls. Use data loss prevention (DLP) rules, access restrictions, and labels to limit what can be shared with AI services.
  5. Manage identities and access. Require corporate accounts, enforce single sign-on where possible, and remove access promptly when people change roles or leave.
  6. Review vendors and contracts. Check data retention, model training, data location, and security terms before approving a tool.
  7. Monitor cost and usage. Track usage-based billing and set limits to avoid unexpected expenses.
  8. Train employees. Explain which data may and may not be shared, why, and how to request approval for new tools.
  9. Assign ownership and review regularly. Establish responsibility across IT, security, legal, and business units, and update the policy as tools and regulations change.
Governance dashboard with approved tools checklist A monitor displays a list of approved tools as checked rows, with a shield and a padlock icon beside the list.
A central inventory and clear policy make AI use visible and manageable. Illustrative image.

Balancing Productivity and Protection

AI tools can improve productivity, and many employees rely on them to do their jobs. The goal of governance is not to block adoption but to make it visible and safe. BetterCloud frames the issue as a choice between moving quickly and staying secure, and argues that organizations can pursue both through discovery and approved tooling. This is the vendor's perspective and should be evaluated against each company's risk profile.

Conclusion

Unmanaged AI tool use is a measurable governance challenge. Organizations struggle to identify the tools in use, control the data shared with them, and enforce policies for embedded and personal AI services. The risks involve data exposure, privacy, security, compliance, intellectual property, and cost. Organizations can reduce these risks by building an accurate inventory, setting clear policies, providing approved tools, controlling data flows, and reviewing their practices regularly.

Frequently Asked Questions

What is shadow AI?

Shadow AI is the use of AI tools, features, or agents within an organization without IT approval, oversight, or data controls.

Why is shadow AI a security risk?

It can expose confidential or personal data to services with unknown retention and training terms, and it can create access paths that security teams cannot monitor.

How can a company find out which AI tools employees use?

Organizations can combine SaaS discovery tools, identity and access logs, browser extension inventories, and endpoint or network monitoring. Employee surveys can complement these methods but should not be the only source.

Does banning AI tools solve the problem?

Usually not. Bans often push usage into personal accounts and devices, reducing visibility. Approved tools, clear rules, and monitoring are generally more effective.

What should a company do first?

Start with an inventory of AI tools and features in use, then define a usage policy and data classification rules. Address the highest-risk data flows first.

References

  1. BetterCloud. The 2026 State of SaaS Report. July 15, 2026.
    https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/

    Supports: SaaS approval rate (56%), AI application average (27), discovery of unsanctioned tools (21%), mid-market growth (41%), data leaks from AI tools (18%), offboarded-user breaches (18%), usage-based billing.

  2. BetterCloud. How to eliminate shadow AI risk while moving fast. July 21, 2026.
    https://www.bettercloud.com/monitor/unmasking-and-eliminating-shadow-ai-risk/

    Supports: definition of shadow AI and its common forms.

  3. MES Computing. "Nearly Half Of SaaS Applications Operate Outside IT Visibility, New Report Finds." 2026.
    https://www.mescomputing.com/news/2026/business/nearly-half-of-saas-applications-operate-outside-it-visibility-new-report-finds

    Supports: secondary confirmation of BetterCloud figures (56%, 41%, 18%).

  4. LayerX Security. State of AI Usage Report 2026.
    https://go.layerxsecurity.com/hubfs/State_of_AI_Usage_Report_2026.pdf

    Supports: 47% of enterprise AI conversations through personal identities; more than 6% containing sensitive data.

  5. Akamai. Enterprise AI Usage Risk Report 2026, State of the Internet, Vol. 12, Issue 04.
    https://www.akamai.com/site/en/documents/state-of-the-internet/2026/enterprise-ai-risk-report.pdf

    Supports: risks from personal AI accounts, unapproved AI apps, browser and IDE extensions, and AI agents.

  6. LastPass. The LastPass 2026 State of AI and SaaS Security Report.
    https://www.lastpass.com/resources/reports/state-of-ai-and-saas-security-2026

    Supports: 73% of organizations lack a comprehensive, enforced AI usage policy.

  7. IBM and Ponemon Institute. Cost of a Data Breach Report 2026.
    https://www.ibm.com/reports/data-breach

    Supports: record average breach cost, 12% increase, and rise in AI-driven attacks.

  8. Brazil. Lei nº 13.709, de 14 de agosto de 2018 (Lei Geral de Proteção de Dados Pessoais).
    https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm

    Supports: personal data processing obligations in Brazil.

  9. European Union. Regulation (EU) 2024/1689 (Artificial Intelligence Act).
    https://eur-lex.europa.eu/eli/reg/2024/1689/oj

    Supports: risk-based obligations for AI systems.

  10. National Institute of Standards and Technology (NIST). Artificial Intelligence Risk Management Framework (AI RMF 1.0).
    https://www.nist.gov/itl/ai-risk-management-framework

    Supports: governance recommendations.