Shadow AI: what security leaders need to do instead of banning

TL;DR: Shadow AI is rising because employees use unapproved AI tools, accounts and features to get work done, with Verizon cited by Hoxhunt finding 45% of employees use AI regularly on work devices, up from 15% a year earlier. Bans rarely remove the behaviour; the secure path has to be easier than the unsafe one.

Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “You Can't Ban Your Way Out of Shadow AI”.

By the numbers:

• 45% of employees use AI regularly on work devices, approved or not, up from 15% a year earlier.
• 63% of UK workers had already used generative AI for work, and nearly a third of those users were doing so without their employer's knowledge.
• 67% of employees accessing AI services were using non-corporate accounts on their work devices.

Key questions

Q: How should security teams govern shadow AI without blocking productivity?

A: Use visibility-based controls instead of blanket bans.

Q: Why does Shadow AI create more risk when employees and developers use enterprise data in external tools?

A: Shadow AI raises risk because external AI services can process sensitive inputs outside approved data protection, audit, and compliance controls.

Q: What are the signs that shadow AI controls are failing in practice?

A: Shadow AI controls are failing when sensitive data moves through copy-paste, uploads, or API calls outside sanctioned workflows, yet the organisation has no alerting or enforcement at the point of transfer.

Practitioner guidance

• Map employee AI usage by account type Identify where staff are using personal, corporate and embedded AI services on work devices, then classify which routes are sanctioned, tolerated or prohibited.
• Review delegated permissions on connected AI tools Audit OAuth grants, email access, storage connectors and CRM integrations that let AI tools act inside other systems, then remove unused or excessive access.
• Shorten the path to approved AI use Make the sanctioned route faster than the workaround by reducing approval friction, publishing approved tool lists and giving clear guidance on data handling.

Bottom line: Shadow AI persists when employees can reach AI through easier routes than the ones security teams approve.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →