What Is Shadow AI? Risks, Examples and How Companies Can Control It

In IBM's 2025 breach research, one in five breached organizations reported a breach involving shadow AI. Among breached organizations, those with a high level of shadow AI saw the breach cost $670,000 more on average than organizations with a low level or none at all. None of it usually starts as a security incident, though. It starts as someone trying to get their work done faster than their company's approved tools allow.

That gap, between how ordinary the behavior feels and how expensive it gets, is what makes shadow AI hard to manage. Adoption happens one person at a time, and by the time a company notices, dozens of unapproved AI tools may already be touching its data.

Here's what shadow AI means, why it spreads, what it looks like in practice, and what companies can realistically do about it.

What Is Shadow AI?

Shadow AI is the unsanctioned use of an AI tool or application by employees, without the formal approval or oversight of their IT or security department. It covers free chatbot accounts used for work tasks, AI browser extensions, AI features quietly enabled inside SaaS tools, coding assistants running on personal logins, and open-source models employees install on company laptops.

A few distinctions are worth being precise about, since they get blurred often:

• The test is whether the use is approved and overseen by the organization, not which specific tool or vendor is involved.
• A personal account doesn't prove a violation by itself. What matters is the company's actual policy and whether this particular use falls inside it.
• A model running locally on someone's own device can still be shadow AI if nobody approved it. Where the processing happens and whether it was authorized are separate questions.
• An approved cloud AI tool doesn't become shadow AI just because the processing happens in the cloud.
• Approval of a SaaS product doesn't automatically extend to a new AI feature the vendor adds to it later.

IBM's definition frames shadow AI the same way, and treats it as a direct descendant of an older problem: shadow IT, the use of any unapproved software or service without IT's knowledge, from personal cloud storage to an unauthorized messaging app. Shadow AI inherited that pattern's usual cause along with its name.

The comparison shouldn't be read as shadow IT being the smaller problem. An unapproved cloud storage account or messaging tool can expose plenty of files, credentials, and access on its own. What's different with AI sits in three places: what tends to end up inside a prompt or an uploaded file, since people often explain their whole problem rather than share a single document; the processing and retention terms attached to that specific tool and account, which vary by product and plan rather than being fixed; and, increasingly, what an AI agent is allowed to do on someone's behalf once it can act rather than just answer.

Why Employees Use Shadow AI

Most usage traces back to a gap, not a grudge. Microsoft and LinkedIn's 2024 Work Trend Index, based on a survey of 31,000 people across 31 countries, found that 75% of knowledge workers already use AI at work, and 78% of those users bring their own tools rather than wait for one to be issued. Sanctioned software is often slower to arrive, more restrictive, or simply doesn't exist yet for a given task, so people route around it the same way they always have with shadow IT.

Banning the behavior outright rarely removes it on its own. It tends to just move the same activity further out of view, which is worse for visibility than the original problem. The next section shows what that looks like once it's already happened.

Real Examples of Shadow AI

The most thoroughly reported case is Samsung's. In March 2023, the company's semiconductor division had recently allowed employees to use ChatGPT. Within about three weeks, three separate incidents surfaced: one engineer pasted source code from an internal database into ChatGPT to help fix a bug, a second submitted code used to identify defective manufacturing equipment, and a third recorded an internal meeting, transcribed it, and fed the transcript in to generate meeting notes. Samsung banned generative AI tools company-wide the following month. The details of the three incidents were first reported by The Economist Korea and are corroborated in Dark Reading's account of the case.

Worth being precise about what this actually shows. ChatGPT wasn't an unapproved tool at Samsung when these incidents happened, the division had just given employees the green light to use it. What went wrong was what got pasted into it, not that the tool itself was off-limits. That's a genuine data leakage problem either way, but it's a different failure than someone secretly using a banned app: it's closer to a company having no rule yet about what's safe to type into a tool it just approved. It's also why Amazon, JPMorgan Chase, and several major banks issued restrictions on ChatGPT around the same period, in some cases before any incident of their own.

Most shadow AI looks far less dramatic day to day. Common forms include an employee using a personal AI account for work drafts because the company hasn't licensed one, a browser extension that summarizes pages and quietly sends their content elsewhere, an AI feature built into a SaaS tool that activates without anyone in IT approving it, a developer running GitHub Copilot on a personal account against company code, or someone downloading an open-source model to run locally on a work laptop, outside any monitoring.

None of these five scenarios is automatically a violation. Whether each one counts as shadow AI depends on what the company has actually approved, not on the scenario alone:

The Risks of Shadow AI

The clearest evidence of cost comes from IBM's 2025 Cost of a Data Breach Report, based on Ponemon Institute research across 600 organizations breached between March 2024 and February 2025. One in five breached organizations had a breach involving shadow AI, and organizations with a high level of shadow AI saw those breaches cost $670,000 more on average than organizations with a low level or none at all. The same report found that 63% of breached organizations either have no AI governance policy or are still developing one, and among organizations that do have a policy, only 34% regularly audit for unsanctioned AI.

These figures describe breached organizations specifically, not companies in general, and they show a strong statistical association rather than a proven cause. They're a reason to take the gap seriously, not a promise about how much closing it would save any particular company.

Several distinct risks sit behind those numbers. Compliance exposure is often the fastest to bite: customer records pasted into a public chatbot can become an unreported cross-border data transfer under GDPR or a disclosure issue under HIPAA, depending on the data involved and where it went, not automatically in every case. Security blind spots compound it, since a security team can't apply controls, monitor, or respond to a tool it doesn't know exists.

A newer risk is specific to where AI is heading. An unsanctioned chatbot mostly just answers questions. An unsanctioned AI agent can query a database, call an API, or complete a multi-step task on someone's behalf, with no one having reviewed what it's allowed to touch. As agentic tools spread, shadow AI stops being only a data-exposure problem and starts being an actions-nobody-approved problem too.

The Data Leakage Mechanism

Data leakage is the risk underneath most of the numbers above, and Samsung's case shows one way it happens. A person with a real, urgent problem pastes in the fastest input available, without stopping to ask where it goes afterward.

The deeper issue usually isn't that the AI tool itself lacks retention or deletion controls, plenty of providers offer both, depending on the product, plan, and account type. It's that in unsanctioned use, nobody checked. Nobody read the terms, nobody confirmed whether the content trains future models, and nobody configured the settings that would have mattered. Once information leaves the device through a tool the company never vetted, the sender is trusting a policy they usually never read either. The deeper technical breakdown of what happens to a prompt in cloud processing versus local processing is covered in Cloud AI vs Local AI: Which Is Safer for Your Data?

Shadow AI and Security Teams

For a security team, shadow AI's defining problem isn't that it's dangerous. It's that it doesn't appear on the list of things being watched. Traditional monitoring is generally built around sanctioned applications, so an unapproved chatbot or extension doesn't automatically get flagged, even though the underlying network traffic can still be visible to anyone who thinks to look for it.

Getting visibility usually starts with unglamorous, low-tech steps before any tooling: reviewing network and SaaS access logs for traffic to known AI platforms, checking which browser extensions are installed across the organization, and running an honest, anonymous survey asking people what AI tools they actually use and why. The why matters as much as the what, since it points directly at which sanctioned tool would make the workaround unnecessary. For the fuller picture of how ungoverned AI gets exploited once it's in place, see The AI Agent Security Crisis.

How Companies Can Control Shadow AI

The most effective response starts before any policy is written. Give people a sanctioned tool that's actually good enough to use, because a ban with nothing to replace the workaround tends to just push usage further underground. From there, a short, specific policy generally works better than a long one: naming which tools are approved, what data categories are off-limits for AI input, and who to ask when something new comes up beats a vague "use AI responsibly" memo that nobody can act on.

When a new tool, feature, or request surfaces, a short process handles most cases:

1. Identify the tool, feature, and task involved.
2. Determine what data and access it touches.
3. Check the account, processing terms, and settings.
4. Establish approval status and who owns the decision.
5. Approve the scenario, restrict it, or offer a suitable alternative.

Training closes a gap policy alone can't. Most people paste sensitive text into a chatbot because they've never been told not to, not because they were warned and ignored it. Ongoing visibility, through the log reviews and surveys covered above, keeps the picture current instead of accurate only on the day the policy was signed. And where the tooling allows it, giving employees a way to get AI help without their prompts leaving the organization's control removes the underlying reason many of these workarounds exist in the first place.

Where Local AI Fits

One specific piece of the exposure problem, prompts leaving a device for a service nobody vetted, has an architectural answer. Sigma Browser's local AI lets supported tasks run on a local model on a person's own device instead of sending the prompt to a cloud provider.

That's a mitigation for one part of shadow AI, not a substitute for governance, and not an exemption from the definition above. Using Sigma without the required company approval is shadow AI in exactly the same way any other unsanctioned tool is, regardless of whether the processing happens locally. Local AI also doesn't cover every Sigma feature: web search, Deep Research, and some agent workflows still rely on external processing. What it does remove is one common reason people reach for an unapproved tool in the first place, needing AI help without a prompt leaving their machine, not the need for approval itself.

Signs Your Organization Has a Shadow AI Problem

A handful of patterns tend to show up before any formal audit does:

• Employees casually mention "a tool I found" or "an AI I use" that IT has never heard of.
• Personal AI subscriptions show up in expense reports or reimbursement requests.
• A SaaS vendor ships a new "AI-powered" feature that quietly turns itself on, and nobody in IT remembers approving it.
• An anonymous survey turns up tool names that don't appear on any approved list.
• No one in the company can say, with confidence, which AI tools currently have access to its data.

Any one of these is worth a closer look. Several at once usually means shadow AI is already established, not emerging.

Shadow AI in One Sentence

Shadow AI is what happens when the fastest available tool isn't the one IT approved, and the fix is rarely a ban: it's giving people a sanctioned option good enough that the workaround stops being worth the risk. For the specific piece of that risk driven by prompts leaving the device, Sigma's local AI is one option worth knowing about, alongside the policy, training, and visibility work that no tool can substitute for.