--- title: "Shadow AI: 4 out of 5 employees use tools not governed by the company" description: "Shadow AI: Shadow AI: what it is, what risks it introduces and how to govern \nchatbots, data and AI agents used outside IT control" image: https://newsroom.kireygroup.com/hubfs/Cybersecurity_7.webp --- [kireygroup.com](https://www.kireygroup.com/) [![](https://newsroom.kireygroup.com/hubfs/item-2020-dicembre/logo-Blog-v2.svg)](https://newsroom.kireygroup.com/en/news) - [Ita](https://newsroom.kireygroup.com/news/shadow-ai-4-dipendenti-su-5-usano-strumenti-non-governati-dall-azienda?hsLang=it) - Eng - [Esp](https://newsroom.kireygroup.com/es/news/shadow-ai-4-de-cada-5-empleados-usan-herramientas-no-gobernadas-por-la-empresa?hsLang=es) [Kireygroup.com](https://www.kireygroup.com/) # Get your daily dose of tech! ## We Shape Your Knowledge # [Welfare: from compliance to competitiveness, digital services and technologies are key to pension funds’ future](https://newsroom.kireygroup.com/en/news/welfare-digital-services-and-technologies-are-key-to-pension-funds-future?hsLang=en) By Michela Sertorio, Business Line Manager - BU Pension Funds atKirey. [Read more](https://newsroom.kireygroup.com/en/news/welfare-digital-services-and-technologies-are-key-to-pension-funds-future?hsLang=en) 9 MIN READ 26 October 2026 ### Latest News - [Welfare: from compliance to competitiveness, digital services and technologies are key to pension funds’ future](https://newsroom.kireygroup.com/en/news/welfare-digital-services-and-technologies-are-key-to-pension-funds-future?hsLang=en) - [Inference Costs: how to prevent AI agents from driving costs up exponentially](https://newsroom.kireygroup.com/en/news/inference-costs-how-to-prevent-ai-agents-from-driving-costs-up-exponentially?hsLang=en) - [Kirey Advisory at the ABI Lab workshop on Processes, Operations and Organization](https://newsroom.kireygroup.com/en/news/kirey-advisory-at-the-abi-lab-workshop-on-processes-operations-and-organization?hsLang=en) - [Kirey Strengthens Its SAP Presence: Mind The Value Achieves Reselling Partner Status](https://newsroom.kireygroup.com/en/news/kirey-strengthens-its-sap-presence-mind-the-value-achieves-reselling-partner-status?hsLang=en) - [The Dark Side of Multicloud: how to prevent workload placement from generating technical debt](https://newsroom.kireygroup.com/en/news/the-dark-side-of-multicloud-how-to-prevent-workload-placement-from-generating-technical-debt?hsLang=en) - [Shadow AI: 4 out of 5 employees use tools not governed by the company](https://newsroom.kireygroup.com/en/news/shadow-ai-4-out-of-5-employees-use-tools-not-governed-by-the-company) - [Cybersecurity](https://newsroom.kireygroup.com/en/news/tag/cybersecurity) / # Shadow AI: 4 out of 5 employees use tools not governed by the company #### Kirey [![](https://newsroom.kireygroup.com/hubfs/it.svg)](https://newsroom.kireygroup.com/news/shadow-ai-4-dipendenti-su-5-usano-strumenti-non-governati-dall-azienda?hsLang=it)    [![](https://newsroom.kireygroup.com/hubfs/ES.svg)](https://newsroom.kireygroup.com/es/news/shadow-ai-4-de-cada-5-empleados-usan-herramientas-no-gobernadas-por-la-empresa?hsLang=es) 11 MIN READ 29 September 2026 - Share on: - - - - [All](https://newsroom.kireygroup.com/news?hsLang=en) - Categories + - [Corporate](https://newsroom.kireygroup.com/en/news/tag/corporate) - [Cybersecurity](https://newsroom.kireygroup.com/en/news/tag/cybersecurity) - [Cloud](https://newsroom.kireygroup.com/en/news/tag/cloud) - [Data Value](https://newsroom.kireygroup.com/en/news/tag/data-value) - [Innovation](https://newsroom.kireygroup.com/en/news/tag/innovation) - [Artificial Intelligence](https://newsroom.kireygroup.com/en/news/tag/artificial-intelligence) - [Software Development](https://newsroom.kireygroup.com/en/news/tag/software-development) - [Corporate Social Responsibility](https://newsroom.kireygroup.com/en/news/tag/corporate-social-responsibility) - [Advisory](https://newsroom.kireygroup.com/en/news/tag/advisory) - [Welfare & Social Services](https://newsroom.kireygroup.com/en/news/tag/welfare-social-services) - [Press & PR](https://newsroom.kireygroup.com/en/news/tag/press) “*While 80% of professionals use AI in their work,* ***only 22% rely exclusively on tools provided by their company***.” With this finding, **IBM highlights the new dimension of shadow IT,** a new category of risks that companies face when artificial intelligence tools and services are used outside the control, security, and governance processes defined by IT. As mentioned above, this is not the exception but the rule. Let’s take a closer look at what shadow AI is, how widespread it is and, above all, **how to address it effectively.** **Key Points** - Most professionals use AI tools at work, but **few rely exclusively on solutions provided by their company.** - Using AI without supervision can expose confidential data and personal information, creating **compliance risks, financial losses and reputational damage.** - Shadow AI **cannot be governed through bans alone**: discovery, DLP, awareness and agent control can reduce risk without holding back AI adoption. ## Shadow AI: when innovation slips beyond corporate control According to the [Cost of a Data Breach Report 2025](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications%2C-97-of-which-reported-lacking-proper-ai-access-controls), one in five organizations experienced a breach **attributable to shadow AI**, while only 37% have policies in place to manage artificial intelligence and/or identify unauthorized use. We are therefore facing a kind of *perfect storm*: on the one hand, the use of AI outside corporate control processes is growing rapidly; on the other, fewer than one in two companies have defined governance rules and tools capable of addressing the phenomenon and, above all, enforcing those rules. ### What is shadow AI? Shadow AI is the use by employees of AI tools and services that are not governed by the company. It follows the same principle as shadow IT: external technologies enter work processes **without going through IT controls.** In this respect, the key characteristic of AI is **its extraordinary accessibility**. Setting up ChatGPT, Claude or Gemini takes just a few clicks and, within certain limits, is also free. If, until yesterday, shadow IT involved sharing confidential documents on WhatsApp, using personal cloud services or independently activating SaaS applications, today a single action is enough to ask a chatbot to **summarize a confidential document, analyze project materials or process data** that, due to internal policies or regulatory requirements, should remain within the corporate perimeter. The underlying behavior has not changed: the tools have changed, but the problem remains the same. Once information leaves the perimeter governed by the company, **it is no longer possible to have full control over how it will be processed, stored, or potentially reused**, nor can it be ruled out that the service provider itself could become involved in a data breach. ### Shadow AI: here are the new risky behaviors The potential consequences of shadow AI are fairly intuitive: **data loss or breaches, financial damage, compliance issues, exposure of intellectual property,** and reputational consequences. Less obvious, and therefore more interesting, is understanding which everyday behaviors can generate these risks, considering that ChatGPT, Claude and similar tools **are becoming part of an increasing number of personal and professional activities.** As often happens with new technologies, adoption starts primarily among younger generations but tends to become part of the routine of the entire workforce, **inevitably reducing risk perception**. The most obvious example is uploading confidential documents into a chat. Fortunately, it is also the behavior most likely to raise concerns among **anyone with even a basic familiarity with digital tools**. More insidious are other behaviors that risk going unnoticed: 1. **Entering sensitive and confidential information into prompts,** such as customer names, project details, orders, and financial data; 2. **Pasting portions of application code** to have them corrected or optimized; 3. Submitting **emails or internal conversations** to AI for summaries and translations; 4. Using **AI browser extensions** that access the content displayed while browsing and transcribe it into external documents (scraping); 5. Using personal accounts for professional activities. Here, the risk is twofold: not only do users **bypass corporate policies and controls**, but they also cannot rely on the **protection provided by the vendor to business accounts.** Just as with WhatsApp, with AI models too, the risk arises from how ordinary the action feels. The user does not feel they are doing anything wrong, let alone sharing confidential company information with an external party, but that is exactly what is happening. ## Shadow Agent: the new IT challenge So far, we have associated shadow AI primarily with the uncontrolled use of commercial generative AI models. This is still the most widespread and difficult risk to contain, but another phenomenon is also emerging in companies: **shadow agents**, meaning AI agents introduced, configured, or developed without going through IT supervision processes. Once again, **the key factor is ease of access**. Today, there is no need to launch a software project to deploy an agent capable of performing relatively simple tasks such as sorting incoming emails, updating a CRM, or gathering information from multiple applications to prepare a report. SaaS services and *low-code* platforms **make it possible to build basic agentic automations in a very short time.** It is therefore unsurprising that unauthorized agents **are already becoming a problem**, to the point that a 2026 study by the [Cloud Security Alliance](https://cloudsecurityalliance.org/blog/2026/04/28/the-shadow-ai-agent-problem-in-enterprise-environments) found unknown AI agents in IT **at 82% of the companies surveyed**, highlighting the scale of the phenomenon. Compared with chatbots, **not only the dynamics but also the scale of the risk changes**. With a chatbot, the risk stems from an intentional action, because the system receives the data that a person decides to enter into the conversation; an agent, on the other hand, can act autonomously, working across email inboxes, SaaS applications, repositories, databases and other corporate systems. But where is the data stored? Who has access to it? Who is it shared with? ## Shadow AI: effective strategies for containing it Eliminating shadow AI is extremely complex and probably unrealistic. An employee can use a personal account, an unmanaged device, or a connection outside the corporate network, **making part of the phenomenon invisible.** This does not mean that IT is without tools; on the contrary, it can reduce risk without compromising productivity by combining **visibility, data protection, culture and access control.** - **Start with discovery, while understanding its limitations**   The first step is simply common sense: you need to understand **which AI tools are actually present within the organization**, including chatbots, browser extensions, and AI features built into SaaS applications. Network monitoring, access and log analysis can uncover a significant portion of these uses, but not 100%, precisely because, for example, a personal account used from a smartphone over a mobile network may escape corporate visibility. Discovery should therefore not be interpreted as a definitive inventory, but as an observatory capable of highlighting patterns, widely used tools and organizational areas where the phenomenon is more intense. - **Protect data at the source** With shadow AI, **control needs to be applied to the data itself**. Data classification and DLP (Data Loss Prevention) can prevent or limit the download, copying, sharing, and transfer of the most sensitive information, regardless of the application to which the user attempts to move it. This also makes it possible to avoid a binary approach based exclusively on *allowed* or *forbidden*. - **Focus on behaviour and awareness** No DLP system can absolutely prevent a person from reading information and manually entering it into an external service. **Awareness of risks and consequences** remains essential, provided it goes beyond the usual recommendation not to share confidential information. The focus should be on gray areas in particular: Can I paste an email I received from a customer? Can I have a few lines of code corrected? Can I upload a presentation after deleting the company name? At the same time, shadow AI can be a useful signal for the organization, because it shows which tools and features people consider most effective for speeding up their work and increasing productivity. Observing these uses therefore allows IT to identify real needs and assess the development or purchase of equivalent solutions. - **With shadow agents, control identity, privileges and capabilities** Since agents usually connect to corporate systems, this gives **IT greater opportunities for detection and control**. Once identified, IT can choose whether to block an agent or assess its usefulness and turn it into a governed component. In the latter case, it is essential to assign it a specific identity, limit its privileges, precisely define which data it can access and which actions it can perform, apply logging and DLP, and introduce human approval for more sensitive activities. ## Kirey: governing AI to accelerate adoption One of our goals is to support customers on their journey toward becoming AI-first organizations. It’s an ambitious target that can generate enormous benefits, but it inevitably also introduces new areas of risk. In this scenario, **governance is a priority for Kirey**: we help our customers define appropriate guardrails, protect data and systems, govern identities and privileges, but also, and above all, enable people to take full advantage of AI’s capabilities without exposing the organization to avoidable risks. [Contact us](https://www.kireygroup.com/en/contact) to start a journey together toward safer, more informed and better-governed AI adoption. - [Previous post](https://newsroom.kireygroup.com/en/news/legacy-modernization-in-banking-discover-the-true-cost-of-legacy-systems?hsLang=en) - [Read all posts](https://newsroom.kireygroup.com/en/news?hsLang=en) - [Next post](https://newsroom.kireygroup.com/en/news/the-dark-side-of-multicloud-how-to-prevent-workload-placement-from-generating-technical-debt?hsLang=en) ## Related posts: #### [Autonomous SOC: reality, limitations, and prospect...](https://newsroom.kireygroup.com/en/news/autonomous-soc-reality-limitations-and-prospects-for-ai-driven-security?hsLang=en) Artificial intelligence is certainly not new to the world of cybersecurity. For more than a decade, ... [Read more](https://newsroom.kireygroup.com/en/news/autonomous-soc-reality-limitations-and-prospects-for-ai-driven-security?hsLang=en) 11 MIN READ 29 September 2026 #### [Cybersecurity awareness must change form: human de...](https://newsroom.kireygroup.com/en/news/cybersecurity-awareness-must-change-form-human-decision-quality-at-the-center?hsLang=en) By Roberto Marzocca, Head of Cybersecurity di Kirey For a long time, the cybersecurity sector has ar... [Read more](https://newsroom.kireygroup.com/en/news/cybersecurity-awareness-must-change-form-human-decision-quality-at-the-center?hsLang=en) 6 MIN READ 29 September 2026 #### [SASE, the model that connects and protects modern ...](https://newsroom.kireygroup.com/en/news/sase-the-model-that-connects-and-protects-modern-it-infrastructures?hsLang=en) Modern companies must ensure high-performing, always-on connectivity for people and digital assets, ... [Read more](https://newsroom.kireygroup.com/en/news/sase-the-model-that-connects-and-protects-modern-it-infrastructures?hsLang=en) 18 MIN READ 29 September 2026 #### Explore - [Home](https://www.kireygroup.com/) - [Competencies](https://www.kireygroup.com/en/competencies) - [Industries](https://www.kireygroup.com/en/industries) - [About Us](https://www.kireygroup.com/en/about-us) - [Tech&Partners](https://www.kireygroup.com/en/tech-partners) - [Careers](https://www.kireygroup.com/en/careers) - [Contact](https://www.kireygroup.com/en/contact) - [Corporate Social Responsibility](https://www.kireygroup.com/en/corporate-social-responsibility) - [Advisory](https://www.kireyadvisory.com/en) #### Policy - [Quality](https://www.kireygroup.com/oven/media/PKG-COMP-AL14-Quality-Policy.pdf) - [Security](https://www.kireygroup.com/oven/media/PKG-CIS-LG02-Security-Policy.pdf) - [Gender Equality](https://www.kireygroup.com/oven/media/PKG-COMP-LG03-Politica-per-la-parita-di-Genere-v2.pdf) - [Service Management](https://www.kireygroup.com/oven/media/PKG-COMP-AL45-Politica-per-la-gestione-dei-servizi.pdf) - [Environment](https://www.kireygroup.com/oven/media/PKG-COMP-AL44-Politica-Ambientale-Kirey.pdf) - [Health, Safety & Wellbeing](https://www.kireygroup.com/oven/media/PKG-COMP-LG02-Policy-on-health-safety-and-well-being-in-the-work-environment.pdf) - [ESG](https://www.kireygroup.com/oven/media/Policy-ESG-ENG-v1.pdf) - [Info on Data Processing](https://www.kireygroup.com/en/information-on-data-processing) #### Certifications - [ISO 9001:2015](https://www.kireygroup.com/oven/media/KIREY-S-R-L-9001.pdf) - [ISO/IEC 27001:2022](https://www.kireygroup.com/oven/media/KIREY-S-R-L-27001.pdf) - [PDR 125](https://www.kireygroup.com/oven/media/PDR-125-2022.pdf) - [ISO/IEC 20000-1:2018](https://www.kireygroup.com/oven/media/ISOIEC-20000-12018-ENG.pdf) - [ISO 14001:2015](https://www.kireygroup.com/oven/media/ISO-14001-2015-ENG.pdf) - [ISO 45001:2018](https://www.kireygroup.com/oven/media/CERTIFICATO-ISO-45001-KIREY-ENG.pdf) - [ISO 22301:2019](https://www.kireygroup.com/oven/media/ISO-22301-2019-ENG.pdf) #### Info **Kirey Srl** [info@kireygroup.com](mailto:info@kireygroup.com) Viale Francesco Restelli, 5 20124 Milano [kirey@pec.it](mailto:kirey@pec.it) **PI/CF**: 06729880960 **REA**: MI 1910802 **Tel**: +39 02 78625200 Capitale sociale 1.089.620,00  [![Linkedin](https://newsroom.kireygroup.com/hs-fs/hubfs/Linkedin.png?width=20&name=Linkedin.png)](https://www.linkedin.com/company/kireygroup/)   - [Privacy Policy](https://www.kireygroup.com/oven/media/Kirey-Privacy-ENG-policy-art-13.pdf) - [Cookie Policy](https://www.kireygroup.com/oven/media/Kirey-Cookie-Policy-ENG-1.pdf) - [Terms and Conditions](https://www.kireygroup.com/oven/media/Kirey-Website-Terms-and-Conditions-1.pdf) [![KIREY LOGO](https://newsroom.kireygroup.com/hs-fs/hubfs/KIREY_LOGO_PAYOFF_RGB_POS.png?width=200&height=72&name=KIREY_LOGO_PAYOFF_RGB_POS.png)](https://www.kireygroup.com/) © Copyright 2026 by Kirey