Shadow AI is any AI tool employees use for work without the knowledge or approval of IT or security: a personal ChatGPT account, an unvetted browser extension, or an AI feature quietly switched on inside a tool you already run. It has stopped being an edge case and become the default way most people use AI at work. Here are the numbers that matter, with their sources.
Key takeaways
- Most workplace AI use is unsanctioned. Bringing your own AI tool is now the majority behaviour, not the exception.
- 43% of breached organisations had a security incident involving shadow AI (IBM, 2026), more than double the year before.
- The problem is governance, not the tools: the organisations getting hurt are the ones with no visibility and no controls.
How widespread is shadow AI?
- 78% of the people who use AI at work bring their own AI tools (Microsoft and LinkedIn, Work Trend Index 2024).
- 75% of knowledge workers use AI at work, and 52% of those who do are reluctant to admit they use it for their most important tasks (Microsoft and LinkedIn, Work Trend Index 2024).
- More than half (55%) of the people who use generative AI at work have used tools their employer has not approved (Salesforce, November 2023).
- Around 80% of the AI tools employees use run without IT oversight (Reco, reported by SC Media, 2026).
What shadow AI costs
- 43% of breached organisations had a security incident involving shadow AI, up from 20% the year before (IBM Cost of a Data Breach Report 2026, 602 organisations in 16 countries and regions).
- The global average breach now costs $4.99 million, a 12% increase year over year (IBM, 2026).
- 68% of breached organisations had no AI governance policies in place. Of the organisations that had an AI-related security incident, 92% lacked proper AI access controls (IBM, 2026).
- Organisations with high levels of shadow AI saw breach costs around $670,000 higher than those with little or none (IBM, 2025).
How sensitive data leaks out
- 39.7% of data movements into AI tools involve sensitive data, and the average employee enters sensitive data into an AI tool about once every three days (Cyberhaven, 2026 AI Adoption & Risk Report).
- 32.3% of ChatGPT use at work runs through personal accounts, outside single sign-on and central logging (Cyberhaven, 2026).
What the numbers actually say
Read together, the picture is consistent: adoption is widespread and mostly invisible, and the cost lands hardest where there is no governance. The failure point is not that people use AI. It is that security teams cannot see what is in use. The organisations that stay ahead make shadow AI visible before writing policy on top of it. That starts with discovering every AI tool in use and keeping a living AI inventory. Grasp finds the AI tools in use through your sign-in, the interviews and Pulse, a small app on company laptops, so governance is built on the real picture rather than a survey. Talk to us.
Frequently asked questions
What percentage of employees use shadow AI?
Estimates range from 55% to 78% of the people who use AI at work, depending on the survey. The 2024 Work Trend Index from Microsoft and LinkedIn found 78% of AI users bring their own tools; Salesforce (2023) found 55% of generative AI users have used unapproved tools. Across studies, the consistent finding is that most workplace AI use is unsanctioned.
How much does shadow AI add to breach risk?
Per IBM's Cost of a Data Breach Report 2026, 43% of breached organisations had a security incident involving shadow AI, more than double the 20% seen a year earlier. IBM's 2025 report found breach costs around $670,000 higher at organisations with high levels of shadow AI.
Is shadow AI a security risk?
Yes, mainly because of what it hides. Cyberhaven (2026) found 39.7% of data movements into AI tools involve sensitive data, and IBM (2026) found 68% of breached organisations had no AI governance policies in place. The risk is the lack of visibility and control, not AI use itself.
How do you manage shadow AI?
Start by discovering every AI tool in use, build an inventory, then apply governance. You cannot govern what you cannot see.
Sources
IBM Cost of a Data Breach Report 2026 and 2025 · Microsoft and LinkedIn Work Trend Index 2024 · Cyberhaven 2026 AI Adoption & Risk Report · Salesforce Generative AI Snapshot, November 2023 · SC Media on Reco's State of Agent Security 2026.