Ask a security team what keeps them up and you'll hear about ransomware, phishing, supply chain. Ask what's actually happening in their organisation right now and the honest answer is more mundane: someone in finance is pasting a supplier contract into a consumer chatbot to get a summary before a 3pm meeting.
98% of organisations report unsanctioned AI use. Roughly 67% of employees use AI tools at work. And only 18% have a formal AI security policy. That gap has a name — shadow AI — and as of 2026 it also has a price.
The number that changed the conversation
IBM's 2026 breach research found that shadow-AI-linked incidents jumped from 20% to 43% of all AI-related breaches in a single year, with an average cost of $5.39 million. That's no longer a governance abstraction; it's a line in an incident report.
The exposure concentrates exactly where you'd least want it:
- 72% of financial-services employees use at least one unsanctioned AI tool — in an industry carrying some of the highest regulatory risk for unauthorised data processing.
- 45% of legal professionals use consumer AI tools for work, with obvious privilege and confidentiality implications.
- In healthcare, patient data turns up in a meaningful share of AI data events.
And the structural cause is ownership: no single function owns more than 25% of AI governance. IT leads at 25%, risk management at 18%, cross-functional arrangements at 17%. When everyone owns it, nobody does.
Why almost nobody involved is a villain
This is the part that changes the response. Shadow AI is not an insider-threat story. It's a convenience story. Your people are using these tools because they work, because the sanctioned alternative is slower or doesn't exist, and because the cost of asking permission is higher than the perceived risk of not asking.
Which is why the instinctive response — ban it — reliably fails. People have phones. A ban doesn't remove the behaviour; it removes your visibility of the behaviour, converting a risk you could have measured into one you can't. You end up with a policy to point at after the incident and no fewer incidents.
What actually works
Four moves, in order of impact:
- See it first. Discover which AI tools are actually in use — through network and SaaS telemetry, expense data, and simply asking without blame. You cannot govern usage you cannot measure, and the answer is always broader than the policy assumes.
- Give people a better sanctioned path. This is the one that moves the needle. If the approved tool is genuinely as good and as fast — grounded in your own data, integrated where people work — usage migrates on its own. Adoption follows convenience, not policy. For most of our clients that means Copilot done properly rather than a half-configured rollout people route around.
- Classify what must never leave, and enforce it at the data layer. Sensitivity labels and DLP put the control where the data is rather than relying on everyone remembering the rules under deadline pressure.
- Give governance one owner. Not a committee. A named person accountable for the inventory, the policy and the exceptions — the same discipline behind any credible AI governance programme.
It compounds with the identity problem
Shadow AI rarely arrives alone. Unsanctioned tools get connected with API keys and OAuth grants, adding to the pile of non-human identities that already outnumber your people by a median of 45 to 1 — most with no owner, no expiry and no review. Governing the tools and governing the identities they create are the same programme.
The bottom line
Shadow AI is not a future risk to budget for in 2027; it's a present one sitting at 43% of AI-related breaches. The response that works isn't prohibition — it's visibility, a better sanctioned option, enforcement at the data layer, and a single owner. Do those and usage moves into the light, where you can actually govern it. That balance of enablement and control is the core of our cybersecurity and resilience work.
Not sure what your team is actually using? Let's find out, without blame.