As employees experiment with AI on their own, a new cybersecurity risk has taken root: shadow AI. 

When workers use personal or unapproved AI tools to handle sensitive information, they can inadvertently expose their organizations to data breaches, compliance violations, and costly operational disruptions.

One way organizations can reduce risks like shadow AI is by investing in advanced cybersecurity education and training, helping teams build the skills needed to govern, detect, and respond to unauthorized AI use.

This report explores the latest research and statistics to show how widespread shadow AI has become, the financial toll it carries, and the steps companies must take to regain control.

Editor’s Choice Shadow AI Stats

The Rise of Shadow AI Use

Shadow AI has quietly become one of the fastest-growing technology trends in the workplace.

Employees are using AI tools to streamline their work long before formal company policies are in place. As a result, nearly every organization now faces the challenge of managing unauthorized AI tools that operate outside official oversight.

The vast majority (98%) of organizations have employees who use unsanctioned apps like shadow AI (Varonis)

This number shows that shadow AI is not an isolated issue; it is nearly universal. Almost every organization has employees using unapproved AI tools, whether to boost efficiency or simply explore new technologies. The challenge is that these tools often bypass IT oversight, exposing companies to hidden vulnerabilities.

The reported daily AI use has increased from 4% to 8% of employees from June 2024 to June 2025 (Gallup, June 2025)

While this statistic doesn’t differentiate between authorized and unauthorized AI use, it does demonstrate how quickly things are changing. AI is moving from occasional experimentation to a core part of daily workflows. For many organizations, this surge is happening faster than governance or training programs can keep up.

A 100% year-over-year increase highlights how rapidly AI is becoming part of daily work routines (Gallup, June 2025)

This growth marks a clear shift in workplace behavior. AI is no longer viewed as a novelty but as a daily productivity tool that employees rely on to complete essential tasks. The rapid pace of adoption leaves many organizations struggling to balance innovation with security and compliance.

Frequent AI use (a few times a week or more) grew from 11% in 2023 to 19% in 2025 (Gallup)

This increase shows that AI is no longer a fringe technology used by a select few employees. It has become part of the regular workflow for nearly one in five workers. As AI becomes more integrated into daily routines, organizations must quickly adapt policies to guide its safe and effective use.

78% AI users bring their own AI tools to work (BYOAI) (Microsoft WorkLab)

This finding highlights how deeply AI has penetrated daily work routines. Most employees are not waiting for IT departments to provide tools. They are adopting them independently. This behavior underscores both the enthusiasm for AI’s potential and the urgency for organizations to establish clear governance frameworks.

80% of employees at small and medium-sized companies use their own AI tools (Microsoft WorkLab)

Smaller organizations often have fewer formal technology controls, which makes them especially vulnerable to shadow AI growth. Many employees at these companies adopt personal AI tools to enhance productivity or fill gaps left by limited IT resources. While this can accelerate innovation, it also heightens exposure to compliance and data security risks

68% of employees use free-tier AI tools like ChatGPT via personal accounts (Menlo Security)

Free versions of AI tools make adoption easy and immediate. However, these tools often lack the data protections found in enterprise plans, creating significant risks when employees share company information.

29% of employees pay for their own AI tools at work (Exploding Topics, August 2025)

This trend shows how personally invested employees have become in AI. Many are willing to spend their own money to access advanced features that help them work faster and more efficiently.

With 98% of organizations reporting unsanctioned AI use and 78% of employees bringing their own tools, roughly three-quarters of businesses (76%) now have active BYOAI use within their workforce (Original Stat)

This overlap reveals how widespread the shadow AI phenomenon has become. The majority of companies now operate with at least some unauthorized AI use, making BYOAI a mainstream part of the modern workplace rather than a fringe behavior.

Shadow AI spans all generations (Microsoft WorkLab):

Shadow AI use cuts across every age group in the workforce:

Younger employees tend to be more comfortable experimenting with AI, while older professionals are adopting it quickly to stay competitive.

Training Awareness and Gaps

Even as AI use accelerates, employee education and organizational policy have not kept pace. Many workers are adopting AI tools without understanding the privacy, security, or compliance risks involved. This section examines how limited training, unclear communication, and missing governance structures contribute to the growing gap between AI innovation and responsible implementation.

58% of employees haven’t received formal training on safe AI use at work (Cybsafe and National Cybersecurity Alliance, September 2025)

This statistic underscores one of the biggest challenges in AI adoption: education. More than half of workers are using AI tools without guidance on safe or compliant practices, leaving organizations exposed to unnecessary risk. 

22% say their organization has communicated a clear plan for integrating AI (Gallup, June 2025)

This lack of clear communication leaves employees uncertain about how AI fits into their daily responsibilities. Without consistent messaging from leadership, even well-intentioned workers may use AI in ways that conflict with company policies or ethical standards.

78% of organizations have not communicated to employees a clear plan for integrating AI into the workplace, despite 98 in 100 firms reporting unauthorized use of Shadow AI (Original Stat)

This demonstrates a major disconnect between awareness and action. While most companies recognize shadow AI as a problem, few have established a clear roadmap for responsible adoption or risk management.

Just 30% of US employees say their company has AI use guidelines or a formal policy (Gallup, June 2025)

Without a formal policy, employees are left to make their own decisions about how to use AI safely. This lack of structure increases the likelihood of data leaks, compliance issues, and inconsistent application of AI across departments.

Although 30% of employees say their organization has AI use policies, 58% report receiving no training on safe AI practices, representing a 28-point gap that underscores the disconnect between policy creation and employee understanding 

This gap highlights that policy alone is not enough. Education and communication are essential for responsible AI use. Organizations must pair written guidelines with practical training to close the knowledge gap.

Security Data Risk 

As shadow AI use expands, data protection has become one of the most urgent challenges for organizations. Employees often input or share confidential information with unvetted AI tools, unaware of how that data may be stored or reused. This section explores the growing evidence of AI-related breaches, illustrating how human behavior, weak access controls, and a lack of oversight combine to create serious security vulnerabilities.

Over half of employees have entered sensitive information in AI tools (Communications of the ACM)

More than half of employees have entered sensitive or proprietary data into AI tools. While this often happens out of convenience or curiosity, it increases the chance of unintentional data leaks that can expose confidential information.

43% of employees admitted to sharing sensitive work information with AI tools without their employers’ permission (Cybsafe and National Cybersecurity Alliance, September 2025)

Nearly half of employees have shared sensitive work data with AI tools without company approval. This unintentional information sharing increases legal exposure and erodes organizational control over confidential assets.

38% of employees share confidential data with AI platforms without approval (Cloud Security Alliance)

More than a third of employees are sharing confidential data with AI systems that fall outside of company oversight. These unsanctioned uploads can expose trade secrets, client information, or internal communications, creating serious legal and reputational risks.

47% of respondents report that their organizations have experienced at least one negative consequence from the use of gen AI (McKinsey)

Nearly half of organizations have already encountered problems with the use of generative AI. These issues range from data leaks and misinformation to compliance breaches, demonstrating that even well-intentioned experimentation, authorized or not, can have costly side effects if guardrails are not in place

20% of organizations in IBM’s analysis have suffered a security breach related to shadow AI (IBM, August 2025)

One in five organizations has already experienced a breach tied to shadow AI, demonstrating that the risks are no longer hypothetical. These incidents often stem from employees using unvetted tools or sharing sensitive data without realizing the exposure it creates.

Security breaches at high-shadow-AI organizations resulted in more personally identifiable information (65%) and intellectual property (40%) being compromised (IBM, August 2025)

Shadow AI breaches tend to be more severe than traditional data incidents. When sensitive customer or company data is processed through unapproved tools, it increases the risk of exposure and makes remediation far more complex.

92% of AI-related breaches lacked proper AI access controls (IBM, July 2026)

This statistic highlights one of the most fundamental gaps in AI security. Without strong access controls, sensitive data can be exposed through shared accounts, unverified plug-ins, or misconfigured permissions, making it an easy target for attackers.

Financial and Operational Impact

As AI adoption accelerates, its financial implications are becoming impossible to ignore. The cost of data breaches tied to shadow AI continues to climb, especially in the US, where regulatory penalties and recovery expenses are highest. This section breaks down the measurable impact of unauthorized AI use to show how quickly operational risks can turn into multimillion-dollar losses.

United States average cost: USD 10.22 million (a 9% increase from 2024, the highest globally) (IBM, August 2025)

The US continues to experience the highest data breach costs in the world. The growing expenses reflect both stricter regulatory environments and higher remediation costs tied to shadow AI-related incidents. 

Customer PII is the most targeted data type (53% of breaches) and most expensive to compromise (USD 166 per record in shadow AI incidents) (IBM, August 2025)

Customer data remains the most valuable and most vulnerable asset for organizations. Breaches involving personally identifiable information are both the most frequent and the most expensive, amplifying the financial impact of shadow AI incidents.

For organizations with high levels of shadow AI, breaches added $670,000 to the average breach cost, a 16% increase compared to those with low levels or none (IBM, August 2025)

Organizations with extensive shadow AI use face significantly higher breach costs. The additional $670,000 average per incident reflects the compounded expenses of data loss, regulatory penalties, and prolonged recovery times.

Policy and Governance Deficiencies

While many organizations have embraced AI tools, few have built the governance structures needed to manage them responsibly. Weak oversight and inconsistent policy enforcement leave companies vulnerable to security breaches, regulatory penalties, and reputational damage. This section examines how gaps in leadership accountability and unclear governance frameworks contribute to widespread policy failures.

Around 68% of organizations have no AI governance policies (IBM, July 2026)

A majority of organizations still operate without any formal AI governance framework. This lack of structure increases the risk that AI tools will be deployed without proper oversight, security checks, or ethical review.

Only 32% had governance policies, with 38% implementing strict approval processes for AI deployments (IBM, July 2026)

Even when organizations do establish governance policies, enforcement is inconsistent. Some limit AI use through strict approval processes, but many still struggle to track or regulate how these systems are actually being applied across departments.

52% of large organizations and 23% of small organizations have built a dedicated team to drive generative AI adoption (McKinsey, 2025)

Larger companies are leading the way in building dedicated AI teams, but smaller organizations lag behind due to limited resources. This divide highlights how access to expertise and funding shapes AI readiness and the gap that allows Shadow AI to thrive.

Half of all employees say their organization’s AI use guidelines are “very clear” (SHRM)

Half of employees report that their organization’s AI use guidelines are unclear. This lack of clarity undermines compliance efforts and leaves workers uncertain about what constitutes safe or acceptable AI use. 

Organizational Readiness

Even as AI capabilities grow, most organizations remain unprepared to manage them effectively. Many companies lack the infrastructure, staff, and strategic planning needed to integrate AI securely and responsibly. This section highlights the current state of readiness and the steps organizations are taking, or still need to take, to close the gap between innovation and accountability.

Three-quarters of employees are expected to use some form of shadow IT by 2027, up from 41% in 2022 (SHRM)

The rapid rise of shadow IT use highlights how quickly workplace technology evolves ahead of regulation. As more employees adopt tools without approval, organizations face growing challenges in tracking, securing, and managing their expanding digital ecosystems.

Less than 33% of respondents report that their organizations are following most of the 12 best practices for gen AI adoption and scaling (McKinsey)

This finding highlights how far most organizations are from operational maturity in AI adoption. While enthusiasm for generative AI is high, many companies lack the structure, standards, and internal coordination needed to scale it effectively and safely.

13% of organizations have hired AI compliance specialists (McKinsey)

Only a small percentage of companies have added dedicated AI compliance roles, showing that most are still in the early stages of building structured oversight. As regulations tighten and enforcement increases, this number is likely to grow rapidly.

Best Practices

Addressing the risks of shadow AI demands structured action. Organizations must move from reactive responses to proactive governance, embedding security, training, and oversight into every stage of AI adoption. The following best practices outline practical steps to mitigate risk, strengthen accountability, and promote safe, transparent AI use.

Conclusion

Shadow AI represents one of the most urgent challenges in today’s digital landscape. The data makes clear that without proper oversight, training, and accountability, even well-meaning AI use can result in costly breaches and lasting reputational harm.

The future of safe AI depends not only on technology but on leadership committed to managing it responsibly.