Shadow AI
The phenomenon of employees using or building AI tools and agents without approval or oversight from the IT department. It represents an AI-era evolution of the shadow IT problem, introducing risks related to data security, regulatory compliance, and uncontrolled costs.
Core Facts
The concept of "shadow AI" is borrowed from "shadow IT" and refers to employees independently procuring or using AI software tools without formal approval from the IT department.
A Gartner 2023 survey showed that more than 55% of employees admitted to using AI tools at work that had not been approved by their organization
Timeline (last 90 days)
Security vendors generally list shadow AI as one of the risk categories most in need of priority response in the near term.
Compared with traditional shadow IT, shadow AI has a lower threshold and spreads faster: employees do not need to install software or request resources, and only need to paste a piece of text into a web page to complete a potential data leak.
Shadow AI refers to the phenomenon of employees using AI tools on their own to handle work matters without the approval of the IT or security department.
All protective measures can only take effect on the premise of knowing what is being used inside the enterprise.
Addressing the shadow AI problem requires first establishing an asset inventory and then keeping that inventory updated in real time — the order cannot be reversed.
Shadow AI exposes enterprises to the risk of being unable to meet the data processing record-keeping requirements of compliance frameworks such as GDPR and HIPAA.
Providing a list of evaluated and approved tools along with a lightweight application channel is a recommended practice for addressing Shadow AI.
Employees pasting internal documents into public large language models for summarization or editing is one of the typical scenarios of Shadow AI.
The Shadow AI phenomenon is similar to the Shadow IT of earlier years, but AI tools have a lower barrier to adoption, spread faster, and are harder to detect.
After an employee leaves, the agents they built may disappear along with them causing business disruption, or continue to operate in an unsupervised state creating security risks.
2 more timeline events
All Facts (13)
The concept of "shadow AI" is borrowed from "shadow IT" and refers to employees independently procuring or using AI software tools without formal approval from the IT department.
75%VerifiedA Gartner 2023 survey showed that more than 55% of employees admitted to using AI tools at work that had not been approved by their organization
65%UnverifiedSecurity vendors generally list shadow AI as one of the risk categories most in need of priority response in the near term.
50%UnverifiedShadow AI refers to the phenomenon of employees using AI tools on their own to handle work matters without the approval of the IT or security department.
50%UnverifiedCompared with traditional shadow IT, shadow AI has a lower threshold and spreads faster: employees do not need to install software or request resources, and only need to paste a piece of text into a web page to complete a potential data leak.
50%UnverifiedAll protective measures can only take effect on the premise of knowing what is being used inside the enterprise.
50%UnverifiedAddressing the shadow AI problem requires first establishing an asset inventory and then keeping that inventory updated in real time — the order cannot be reversed.
50%UnverifiedShadow AI exposes enterprises to the risk of being unable to meet the data processing record-keeping requirements of compliance frameworks such as GDPR and HIPAA.
50%UnverifiedThe Shadow AI phenomenon is similar to the Shadow IT of earlier years, but AI tools have a lower barrier to adoption, spread faster, and are harder to detect.
50%UnverifiedProviding a list of evaluated and approved tools along with a lightweight application channel is a recommended practice for addressing Shadow AI.
50%UnverifiedEmployees pasting internal documents into public large language models for summarization or editing is one of the typical scenarios of Shadow AI.
50%UnverifiedAfter an employee leaves, the agents they built may disappear along with them causing business disruption, or continue to operate in an unsupervised state creating security risks.
50%UnverifiedThe potential risks of shadow AI include enterprise sensitive data being sent to unvetted third-party models, the same functionality being paid for redundantly by multiple teams, and the inability to trace responsibility in security incidents.
50%