Shadow AI: The Next $50 Billion Security Crisis Your IT Team Isn’t Tracking

Originally published in 2025, when SaaSVista focused on shadow SaaS discovery. Edited and republished in October 2026.

Somebody on your team pasted something into a chatbot this week that they shouldn’t have.

Maybe it was a customer email they wanted to soften. Maybe it was a stack trace with a connection string in it. They weren’t being careless. They were trying to get their work done faster, and the tool was one browser tab away.

You don’t know which tool. You don’t know what went in.

That’s shadow AI. It looks like the shadow IT problem I’ve chased for most of my career, and it behaves very differently.

---

About That $50 Billion Number

The headline needs a caveat before we go any further.

When I first wrote this post in 2025, I put a $50 billion annual price tag on shadow AI. That figure was a back-of-envelope estimate, built from rough assumptions about unapproved subscription spend and data exposure. It was not a measurement, and it was not research. Nobody has counted this, including me.

I’ve left the number in the title because that’s what the original said. Read it as “large and uncounted,” and please don’t quote it in a board deck. The argument doesn’t depend on it anyway.

---

Why Shadow AI Isn’t Just Shadow IT Again

I’ve spent 30 years in IT security and infrastructure, and I watched shadow IT grow up. A department signs up for a chat tool, then a project tracker, and IT finds out when the expense report shows up. Annoying, but slow. You had months to notice.

Shadow AI breaks that pattern in three ways.

It spreads faster

A new SaaS app needs a champion, a budget, and usually some setup. A chatbot needs a personal email address. There’s no procurement step and no install, so there’s nothing to slow it down.

Adoption also happens person by person, all at once. By the time you’ve drafted a policy for one tool, people have moved on to others, plus the AI features that quietly appeared inside apps you already approved.

The data goes into the prompt

With old-style shadow IT, the risk was a rogue app holding some of your data. You could find it, export the data, and shut the account down.

With AI tools, the exposure happens at the moment of use. People paste in customer records, source code, financial forecasts, HR notes. Whatever they’re working on goes into the prompt, because that’s the whole point of the tool.

Once it’s submitted, it’s outside your control. What happens next depends on the tool and the plan. Retention periods, whether inputs get used to improve models, where the data is processed. Those terms vary a lot between a consumer account and a business agreement, and they change. If an employee is on a personal account, you never agreed to any of it, and you have no log of what was sent.

This isn’t hypothetical. In 2023 it was widely reported that Samsung restricted employee use of generative AI tools after engineers pasted internal source code into ChatGPT.

Your compliance promises come along for the ride

If you’re subject to GDPR, HIPAA, or you’ve made SOC 2 commitments to customers, you’ve made promises about where data goes, who processes it, and whether you can delete it on request.

An unapproved AI tool is a data processor you never vetted, with no contract in place and no record of the transfer. One prompt containing personal data can put you on the wrong side of several of those promises at once. And you can’t honor a deletion request for data you don’t know you sent.

---

What People Are Actually Using

The names change. The categories hold up.

• General chat assistants. ChatGPT, Claude, Gemini. The broadest exposure, because anything can end up in them.
• Coding assistants. GitHub Copilot and its many cousins. They see source code by design, and sometimes the secrets sitting in it.
• Image and design generators. Midjourney and similar. Reference uploads can include unreleased product designs.
• AI features inside tools you already own. Notion AI, Grammarly, the assistant button that showed up in your CRM last quarter. Easy to miss, because the vendor is already approved. The AI feature may run under different terms than the product you signed up for.
• Meeting notetakers. They join calls, record, and transcribe. Think about what gets said in your leadership meetings.
• Custom GPTs and homemade agents. Someone uploads a knowledge base or a customer export to build a helpful internal bot. Well-intentioned, and it can be a lot of data in one go.

Most of these aren’t installed software. They’re browser tabs and feature toggles, so an inventory of installed applications won’t find them.

---

Why Mid-Market Teams and Developers Are Most Exposed

Large enterprises have governance staff and budget. Very small companies can sort it out in one all-hands conversation. Mid-market companies have too many people to see what everyone’s doing, and not enough security headcount to watch.

A few patterns make it worse:

• The policy nobody reads. It’s in the handbook. Nobody has opened it since onboarding.
• The block that doesn’t block. You blocked a chatbot at the firewall, so people use it on their phones. Same risk, less visibility.
• Remote work. Personal devices and home networks sit outside whatever network controls you do have.
• New hires. They arrive with habits and accounts from their last job.

Developers deserve their own mention. They tend to adopt AI tooling early and use it heavily. They handle some of the most sensitive material you have, including source code, credentials, and production data. They also know how to get around a control that slows them down. I’d do the same in their seat. If you only have the energy to focus on one group first, start there.

---

A 30-Day Discovery Playbook

You can get from “no idea” to “reasonable handle on it” in about a month, without buying anything.

Week 1: Discover

You’re looking for evidence in places you already have access to.

• DNS and proxy logs. Search for the domains of well-known AI tools. It won’t catch personal devices, but it gives you a baseline.
• OAuth grants in your identity provider. Check the connected and third-party apps in Google Workspace, Microsoft 365, or whatever you use for single sign-on. Look for AI tools that employees have granted access to mail, files, or calendars. Those hold standing access.
• Expense data. Search card statements and reimbursements for AI subscriptions.
• Browser extensions. If you manage browsers, pull the extension list. Plenty of AI writing and summarizing helpers can read every page the user visits.
• Ask people. Run a short, anonymous survey. Which tools do you use? What for? What would you need in order to switch to an approved one? Make it clear nobody’s in trouble.

Week 2: Assess

Now sort what you found by what could go wrong.

For each tool, write down what kind of data plausibly goes into it. Customer personal data and source code sit at the top of the list. Marketing copy is near the bottom.

Then check the terms for the plan your people are actually on. Does the vendor retain inputs? Can you turn off training on your data? Is there a business tier with a data processing agreement?

Finally, map the high-risk combinations to your obligations. If you handle health data or EU personal data, or you’ve signed contracts that restrict subprocessors, those go first.

Week 3: Write the Policy

Keep it short enough that people will read it. One page is the goal.

Sort tools into three buckets: approved, approved with conditions, and not allowed. Then add a few plain rules. Don’t paste customer data, credentials, or anything marked confidential into a tool that isn’t on the approved list. Use your work account, not a personal one. A human reviews AI output before it goes to a customer. If you want to use something new, here’s who to ask, and here’s how fast you’ll get an answer.

That last part matters most. If the answer to every request is “no” or silence, people route around you.

Week 4: Deploy Controls

Make the approved path easy first, then close off the risky one.

• Put sanctioned AI tools behind single sign-on, so access follows the employee’s account and ends when they leave.
• Review and revoke the risky OAuth grants you found in week 1.
• Add the AI domains you care about to your existing DNS or proxy monitoring, and alert on new ones.
• If you already own data loss prevention tooling, add rules for uploads to AI sites.
• Block only what you’ve offered an alternative for.
• Put a recurring review on the calendar. Monthly is fine to start.

---

Quick Wins If You Don’t Have a Month

Three things cost almost nothing and you can do them this week.

Publish an approved-tools list. Even a short one. People are far more likely to use the sanctioned option if they know it exists.

Write a short acceptable-use policy. Half a page on what never goes into a prompt. Talk about it in a team meeting so people hear it from a human.

Turn on SSO for the AI tools you do sanction. You get an access log and clean offboarding in one move.

None of this is a finished governance program. It gets you out of the dark.

---

What’s Changed Since 2025

The original version of this post was about employees and chatbots. That story is still true.

What’s grown since is the other half of the problem, AI inside the products companies build and sell. Engineers add model providers and SDKs to a codebase the same way employees add browser tabs, one at a time, without anyone keeping a list. EU AI Act obligations have been phasing in, and enterprise buyers now ask vendors direct questions about how they govern AI.

The discipline is the same in both cases. Know what AI you’re using, understand what it does with your data, and write down your controls. I cover the product side in What Is AI Governance and Why Startups Can’t Ignore It.

---

Key Takeaways

• Shadow AI spreads faster than shadow IT ever did, because there’s no purchase or install to slow it down
• The exposure happens in the prompt, at the moment of use, and what the vendor does with it depends on the tool and the plan
• Unapproved AI tools are unvetted data processors, which puts existing privacy and compliance commitments at risk
• Developers are usually the heaviest users with the most sensitive data, so start there
• Thirty days is enough to discover, assess, write a one-page policy, and deploy basic controls
• An approved-tools list, a short acceptable-use policy, and SSO for sanctioned tools are the cheapest places to start
• The $50 billion figure in the title was a rough 2025 estimate, not a measurement

See how SaaSVista approaches AI governance today →