iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Shadow AI is AI used at work without the organisation’s governance—not just an employee pasting text into a public chatbot. It can include unreviewed browser extensions, task-specific services, internal agents without an owner, and AI models or APIs connected to business data outside the responsible review process. The practical response is to find what is in use, understand the work it supports and the access it has, then decide what to approve, restrict or replace.
What counts as shadow AI?
Microsoft Learn defines shadow AI as AI operating in an enterprise without governance. The defining feature is that the system sits outside the organisation’s controls, not where it runs or whether it looks like a chatbot.
- Unapproved consumer tools: Employees enter work material into a public AI service.
- Unreviewed services or extensions: A browser add-on or task-specific AI product handles work without an assessment.
- Unmanaged internal agents: An agent is deployed inside the organisation but has no registered owner or applicable policy.
- Unreviewed integrations: A developer or team connects a model or API to business data or workflows outside the responsible governance process.
These cases differ in data exposure, access and potential impact, so an organisation should not treat every instance as the same risk. Microsoft Learn’s guidance captures the central visibility problem: “The risk isn’t that employees use AI; it’s that an organization cannot account for the AI it doesn’t know about.”
Why employees adopt AI outside approved channels
Unofficial use can point to a real productivity need or a gap in the organisation’s approved offer. Employees may find a tool familiar, easy to access or better suited to a particular task. Microsoft advises organisations to use what they discover to understand where employees see value and where approved options are not meeting needs; difficult-to-find or difficult-to-use alternatives can encourage workarounds.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
In a Microsoft-commissioned Censuswide survey of 2,003 UK employees aged 18 and over, conducted in October 2025, 71% said they had used unapproved consumer AI tools at work. Among respondents who used shadow AI, 41% cited familiarity from personal life and 28% said their company did not provide a work-approved option. These figures describe that UK employee sample, not workforces globally.
That makes shadow use useful as a signal as well as a control gap. A response focused only on prohibition can leave the original task unsolved. Ask what employees are trying to accomplish before deciding whether to approve the tool, offer a safer alternative or stop a use that cannot be made acceptable.
What risks should leaders assess?
Data exposure and incomplete records
An unreviewed service may receive corporate or customer information without the organisation knowing its retention, access or handling arrangements. If an incident occurs, the organisation may also lack a suitable record of what was sent and when. This does not mean every provider trains on submitted information; the cited guidance does not establish that as a universal practice.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Unclear access and actions
An unmanaged agent may reach data or perform actions that have not been reviewed. The key questions are what it can access, which systems it can affect, what actions it may take without approval and whether those actions are traceable.
Security, compliance and operational impact
An unassessed system can create security or compliance concerns, particularly when sensitive customer or financial data is involved. Whether a specific use breaches a law or creates a particular penalty depends on jurisdiction and circumstances; the general risk alone does not establish either. Agent incidents may also affect operations or finances, but survey findings should not be mistaken for proof that every organisation faces the same prevalence or consequences.
The Cloud Security Alliance’s 2026 survey announcement, based on 418 online responses from IT and security professionals gathered in January 2026 and commissioned by Token Security, reported that 82% of respondents’ organisations had unknown AI agents in their IT infrastructure and 65% had experienced AI-agent-related incidents in the prior 12 months. Among respondents reporting incidents, 61% reported data exposure, 43% operational disruption and 35% financial losses. These are findings from that survey and sample, not universal organisational rates.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A separate Cloud Security Alliance survey announcement on April 16, 2026, covered 445 IT and security professionals responding in September and November 2025; it was commissioned by Zenity. It reported that 54% of respondents’ organisations had between one and 100 unsanctioned AI agents, while 31% reported formally adopted policies for AI-agent use. This is a separate survey and should not be combined with the January 2026 survey as if they were one dataset.
Recommended Free Tools
Misuse and data protection
The UK Information Commissioner’s Office discusses a scenario in which an employee uses agentic AI without permission because they see a benefit but not the wider risks. Its scenario analysis warns of unsuitable use and potential data protection consequences; it is forward-looking scenario material, not an incident count or a certainty about what will happen.
How to turn discovery into proportionate governance
- Discover the footprint. Look beyond a list of approved applications. Check employee-facing AI services and browser extensions, internal agents, developer workflows, API connections and SaaS products with AI features. Microsoft recommends enterprise-wide visibility into agents, users, devices and external AI services; a tool inventory alone may miss agents and integrations.
- Understand the work and data flow. For each discovered use, ask what task it supports, what information users enter or retrieve, which systems are connected, who uses it and what actions it can take. This makes it possible to distinguish a low-impact drafting aid from an agent with access to sensitive records or operational systems.
- Assign an owner and assess risk. Record a responsible person or team, intended purpose, user population, data sensitivity, permissions and likely impacts. A consistent framework can help make assessments repeatable. NIST’s Generative AI Profile is a voluntary, cross-sector companion to AI RMF 1.0 for incorporating trustworthiness considerations into AI design, development, use and evaluation; it does not itself inventory an organisation’s deployed tools.
- Choose controls that match the use. Approve suitable uses, investigate unclear ones, restrict risky data or actions, and block uses that cannot be made acceptable. For agents, define boundaries, control permissions, monitor behaviour, and require risk-based human authorisation for consequential actions. Plan how to retire agents and remove credentials as well as how to deploy them.
- Offer a usable approved route. Make an approved option easy to find and suited to the task employees are trying to complete. Explain how to access it and provide training and support. The UK Cabinet Office’s “People Factor” and “Mitigating Hidden AI Risks Toolkit” are human-centred resources addressing engagement, training, support, risk management and monitoring.
- Review the arrangement over time. Revisit the inventory, owner, data flows, permissions, incidents and employee need periodically. A tool or agent can change, and an approved alternative may cease to meet the task; lifecycle governance should include retirement and credential removal.
These controls can improve visibility and reduce exposure, but no policy or product guarantees safety. The Cloud Security Alliance survey announcements report gaps in visibility, permissions and governance; they do not establish that a particular control will eliminate those gaps.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Framework or discovery software: what is the difference?
| Approach | What it can contribute | What it does not establish by itself |
|---|---|---|
| Governance framework or process | A consistent way to assess and manage risk. NIST’s Generative AI Profile is a voluntary cross-sector reference for trustworthiness across design, development, use and evaluation. | It does not inventory an organisation’s deployed tools, agents or integrations. |
| Discovery or enforcement software | May support discovery or enforcement; capabilities vary by product and deployment. | A vendor description is not an independent evaluation, and software alone does not establish ownership, a suitable policy or a useful approved alternative. |
If evaluating software, assess whether it covers SaaS, endpoints, internal agents and APIs; reveals owners, purposes, data and permissions; supports risk classification, audit and monitoring; enforces policy; integrates with existing controls; and supports lifecycle management. Include employee usability and operational burden in the assessment. The sources cited here do not provide an independent vendor comparison, so claims about specific products should be checked against the organisation’s own requirements rather than treated as comparative evidence.
How to tell whether the response is working
Use governance activity to check whether the organisation is becoming more capable of accounting for its AI, not simply whether it has published a policy. Review whether discovered uses have an owner and documented purpose; whether data and permissions are understood; whether risky actions have appropriate boundaries and oversight; and whether employees can find an approved option that meets their work need. Track unresolved uses and incidents so the organisation can revisit controls and priorities. A low count of reported shadow tools alone is not proof that adoption is visible or risk is managed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
