What Is Shadow AI? Risks, Examples and How Companies Can Control It

In IBM’s 2025 breach research, one in five breached organizations had shadow AI somewhere in the chain, and those breaches cost $670,000 more on average than ones that didn’t. None of it usually starts as a security incident, though. It starts as someone trying to get their work done faster than their company’s approved tools allow.

That gap, between how ordinary the behavior feels and how expensive it gets, is what makes shadow AI hard to manage. Adoption happens one person at a time, and by the time a company notices, dozens of unapproved AI tools may already be touching its data.

Here’s what shadow AI means, why it spreads, what it looks like in practice, and what companies can realistically do about it.

What Is Shadow AI?

Shadow AI is the unsanctioned use of an AI tool or application by employees, without the formal approval or oversight of their IT or security department. It covers free chatbot accounts used for work tasks, AI browser extensions, AI features quietly enabled inside SaaS tools, coding assistants running on personal logins, and open-source models employees install on company laptops. Any AI system processing company data outside an organization’s approved tools and oversight counts, regardless of whether the person using it means any harm.

The definition, and most of the framing around it, comes from IBM, which is now the most widely cited authority on the term. IBM also treats shadow AI as a direct descendant of an older problem: shadow IT, the use of any unapproved software or service without IT’s knowledge, from personal cloud storage to an unauthorized messaging app. Shadow AI inherited that pattern’s usual cause along with its name. What’s different is the object being exposed. Shadow IT typically risks a file or a login. Shadow AI risks whatever a person is willing to type into a prompt, which tends to be far more revealing.

Why Employees Use Shadow AI

Most usage traces back to a gap, not a grudge. Microsoft and LinkedIn’s 2024 Work Trend Index, based on a survey of 31,000 people across 31 countries, found that 75% of knowledge workers already use AI at work, and 78% of those users bring their own tools rather than wait for one to be issued. Sanctioned software is often slower to arrive, more restrictive, or simply doesn’t exist yet for a given task, so people route around it the same way they always have with shadow IT.

Banning the behavior outright rarely removes it. It just moves the same activity further out of view, which is worse for visibility than the original problem. The next section shows what that looks like once it’s already happened.

Real Examples of Shadow AI

The clearest documented case is Samsung’s. In March 2023, engineers in the company’s semiconductor division used ChatGPT to help with real work: one pasted in source code from an internal database to troubleshoot a bug, another submitted code for identifying defective equipment, and a third recorded an internal meeting, transcribed it, and fed the transcript in to generate meeting notes. Three separate incidents surfaced within about 20 days. Samsung banned generative AI tools company-wide the following month, warning that violations could lead to termination.

None of it was malicious. Each employee was trying to solve a real problem with a tool that worked well, which is precisely the profile Microsoft and LinkedIn’s numbers describe. It’s also why Amazon, JPMorgan Chase, and several major banks issued similar restrictions on ChatGPT around the same period.

Most shadow AI looks far less dramatic day to day. Common forms include an employee using a personal AI account for work drafts because the company hasn’t licensed one, a browser extension that summarizes pages and quietly sends their content elsewhere, an AI feature built into a SaaS tool that activates without anyone in IT approving it, a developer running GitHub Copilot on a personal account against company code, or someone downloading an open-source model to run locally on a work laptop, outside any monitoring.

The Risks of Shadow AI

The clearest evidence of cost comes from IBM’s 2025 Cost of a Data Breach Report, based on Ponemon Institute research across 600 organizations in 16 countries. Twenty percent of breached organizations had a breach involving shadow AI, and a high level of shadow AI added an average of $670,000 to the cost of a breach. The same report found that 63% of organizations have no policy in place to manage AI use or catch shadow AI at all.

Several distinct risks sit behind that number. Compliance exposure is often the fastest to bite: customer records pasted into a public chatbot can become an unreported cross-border data transfer under GDPR or a disclosure issue under HIPAA, regardless of anyone’s intent. Security blind spots compound it, since a security team can’t apply controls, monitor, or respond to a tool it doesn’t know exists. That’s why shadow AI functions less like a new threat category and more like a data-loss-prevention program with permanent gaps in it.

A newer risk is specific to where AI is heading. An unsanctioned chatbot mostly just answers questions. An unsanctioned AI agent can query a database, call an API, or complete a multi-step task on someone’s behalf, with no one having reviewed what it’s allowed to touch. As agentic tools spread, shadow AI stops being only a data-exposure problem and starts being an actions-nobody-approved problem too.

The Data Leakage Mechanism

Data leakage is the risk underneath most of the numbers above, and Samsung’s case shows exactly how it happens. A person with a real, urgent problem pastes in the fastest input available, without stopping to ask where it goes afterward. Once a prompt reaches a public AI tool, the sender generally has no way to control retention, no assurance the content won’t be used for training, and no path to delete it if the decision turns out to be a bad one after the fact.

This isn’t an argument that every cloud AI tool is reckless with data. It’s that once information leaves the device, the sender is trusting a policy they usually never read, on a service their company never vetted. The deeper technical breakdown of what happens to a prompt in cloud processing versus local processing is covered in Cloud AI vs Local AI: Which Is Safer for Your Data?

Shadow AI and Security Teams

For a security team, the defining feature of shadow AI isn’t that it’s dangerous. It’s that it’s invisible. Traditional monitoring watches sanctioned applications, and an unapproved chatbot or extension simply doesn’t show up on that map, which means the standard question, "is our data protected?", quietly becomes unanswerable for anything running in the shadow AI layer.

Getting visibility usually starts with unglamorous, low-tech steps before any tooling: reviewing network and SaaS access logs for traffic to known AI platforms, checking which browser extensions are installed across the organization, and running an honest, anonymous survey asking people what AI tools they actually use and why. The why matters as much as the what, since it points directly at which sanctioned tool would make the workaround unnecessary. For the fuller picture of how ungoverned AI gets exploited once it’s in place, see The AI Agent Security Crisis.

How Companies Can Control Shadow AI

The most effective response starts before any policy is written. Give people a sanctioned tool that’s actually good enough to use, because a ban with nothing to replace the workaround just pushes usage further underground. From there, a short, specific policy works better than a long one: naming which tools are approved, what data categories are off-limits for AI input, and who to ask when something new comes up beats a vague "use AI responsibly" memo that nobody can act on.

Training closes a gap policy alone can’t. Most people paste sensitive text into a chatbot because they’ve never been told not to, not because they were warned and ignored it. Ongoing visibility, through the log reviews and surveys covered above, keeps the picture current instead of accurate only on the day the policy was signed. And where the tooling allows it, giving employees a way to get AI help without their prompts leaving the organization’s control removes the underlying reason many of these workarounds exist in the first place.

Where Local AI Fits

One specific piece of the exposure problem, prompts leaving a device for a service nobody vetted, has an architectural answer. Sigma Browser’s Private Mode lets supported tasks run on a local model on a person’s own device instead of sending the prompt to a cloud provider.

That’s a mitigation for one part of shadow AI, not a substitute for governance. Private Mode doesn’t cover every Sigma feature: web search, Deep Research, and some agent workflows still rely on external processing, and using it doesn’t give a company visibility into what its employees are doing or a policy telling them what’s allowed. What it does is remove one common reason people reach for an unapproved tool in the first place: needing AI help without a prompt leaving their machine.

Signs Your Organization Has a Shadow AI Problem

A handful of patterns tend to show up before any formal audit does:

• Employees casually mention "a tool I found" or "an AI I use" that IT has never heard of.
• Personal AI subscriptions show up in expense reports or reimbursement requests.
• Output speed or writing style shifts sharply and uniformly across a team, without a new hire or new process to explain it.
• A SaaS vendor ships a new "AI-powered" feature that quietly turns itself on, and nobody in IT remembers approving it.
• An anonymous survey turns up tool names that don’t appear on any approved list.
• No one in the company can say, with confidence, which AI tools currently have access to its data.

Any one of these is worth a closer look. Several at once usually means shadow AI is already established, not emerging.

Shadow AI in One Sentence

Shadow AI is what happens when the fastest available tool isn’t the one IT approved, and the fix is rarely a ban: it’s giving people a sanctioned option good enough that the workaround stops being worth the risk. For the specific piece of that risk driven by prompts leaving the device, Sigma’s Private Mode is one option worth knowing about, alongside the policy, training, and visibility work that no tool can substitute for.