Shadow AI: The Hidden Risk of Unapproved AI Tools in the Workplace
Employees are increasingly using unapproved AI tools for work, creating significant risks of data leaks, intellectual property loss, and increased breach costs.
The allure of artificial intelligence to streamline workflows and boost productivity is undeniable, but its unapproved use within organizations—termed 'shadow AI'—presents a growing threat to sensitive data. Employees, often driven by a desire to complete tasks more efficiently, are turning to readily available public AI tools like chatbots, assistants, and browser extensions without explicit employer consent. This practice, while seemingly innocuous, can lead to the inadvertent exposure of confidential information, customer details, or proprietary plans to third-party services.
The UK's National Cyber Security Centre (NCSC) defines shadow AI as any AI technology not integrated into an organization's approved systems and processes. A 2025 Microsoft study highlighted the pervasiveness of this issue, revealing that 71% of UK employees surveyed admitted to using unapproved AI tools at work. This trend extends beyond simple chatbots to include AI features embedded in everyday applications, browser extensions, and even custom-built automations that may transmit data to external AI services.
Security and IT departments are particularly concerned because when data is entered into public AI tools, it often leaves the company's direct control. Unless specific privacy safeguards are implemented by the AI service provider, this data can be retained or used for model training, potentially leading to data breaches, loss of intellectual property, and regulatory non-compliance. Furthermore, AI assistants and agents, which can perform actions on behalf of users, introduce additional risks due to their complex software nature and potential vulnerabilities that attackers could exploit to gain access to sensitive data and systems.
IBM's 2025 Cost of a Data Breach report underscored the financial implications of shadow AI, finding that one in five organizations experienced a breach linked to its use. These breaches were associated with an average additional cost of $670,000 per incident. The report also noted that only 37% of organizations had policies in place to manage AI or detect shadow AI, indicating a significant gap in preparedness.
Addressing shadow AI requires a proactive and balanced approach rather than outright bans, which can drive usage further underground. Organizations are advised to offer secure, approved AI platforms with built-in guardrails to meet employee needs. Employees should prioritize using work accounts over personal ones for AI tools, as work accounts are subject to organizational security controls and governance. Clear guidelines on what types of data—such as customer details, financial records, source code, or confidential meeting content—are off-limits for AI processing are crucial.
Employees should also diligently check the privacy settings of any AI tool they consider using, paying attention to whether inputs are stored or used for training. Registering use cases with IT departments and seeking approval for new AI tools can help maintain compliance. Particular caution is warranted for AI agents and plugins that connect to sensitive company resources like email or files, as these require thorough vetting by security teams.
Ultimately, fostering open communication about AI security is key. Encouraging employees to speak up if approved tools do not meet their needs can help IT and security teams identify gaps and provide better solutions. By understanding the risks and implementing clear policies and approved alternatives, organizations can harness the benefits of AI while safeguarding their valuable data and intellectual property.