Two thirds of office professionals have used AI tools their employer never approved. That is the headline number from PagerDuty’s 2026 shadow-AI survey, published in June, covering 1,250 non-technical staff at companies with over half a billion dollars in revenue across the US, UK, Australia and Japan. Eighty-eight percent had put work information into a public model. Thirty-four percent had pasted in customer data.
Those are the numbers everyone quotes. They are not the interesting ones. The interesting number is 72 percent, the share who believe they understand how to use AI for their own job better than the team responsible for governing AI at their company. That is not defiance, and it is not a training gap. It is a governance layer that has quietly lost its authority over the thing it governs, and most security teams have not noticed because nothing has broken yet.
The policy is not missing
The reflex answer to shadow anything is “write a policy.” Eighty-six percent of the people in that survey already work somewhere with an AI policy in place. The policy exists. Two thirds of them went around it anyway.
A second number explains why, and it is the one I would put in front of a board: 81 percent believe AI policies are applied unequally, with leadership held to a looser standard. A rule that staff perceive as selectively enforced does not get obeyed less. It gets routed around entirely, because following it stops looking like compliance and starts looking like being the only person who bothered.
The concealment is measurable on its own. The KPMG and University of Melbourne global study, Trust, Attitudes and Use of Artificial Intelligence, surveyed over 48,000 people across 47 countries and found 57 percent had actively hidden their AI use from managers and colleagues, with some presenting AI output as their own work. That study is from 2025 and the fieldwork is older than the PagerDuty numbers, which makes the direction of travel worse rather than better: the concealment was already normal before the current wave of tools arrived.
What actually leaves the building
Aggregate percentages hide the shape of the risk. It helps to look at what gets pasted, why it gets pasted, and what goes with it that nobody intended to send.
| What gets pasted into a public model | Share | The reason it happens | What travels with it |
|---|---|---|---|
| Emails and correspondence | 43% | “Make this sound less annoyed” | Names, deal terms, the internal disagreement in the thread below |
| Meeting notes and summaries | 40% | “Pull the actions out of this” | Attendees, decisions not yet announced, who objected |
| Customer data | 34% | “Draft a reply to this account” | Personal data with a GDPR basis nobody assessed, contract detail |
| Financial or otherwise confidential information | 31% | “Sanity-check these figures” | Pre-announcement numbers, margins, forecast assumptions |
Read the third column. Every one of those is a person trying to do their job well. Nobody in that table is exfiltrating anything. They are removing friction from a task, using the fastest tool available, exactly as they did with personal Dropbox in 2013 and unsanctioned Slack in 2017.
Tim Armandpour, PagerDuty’s CTO, put the consequence plainly: when over 30 percent of employees are putting confidential company data into public models, shadow AI becomes a massive enterprise liability. He is right about the liability. I would argue he is describing a symptom.
This wave is different, and the difference matters
Previous shadow IT moved files. Someone put a document somewhere the company had not approved, and the exposure was a copy of that document sitting on infrastructure you did not control. Unpleasant, well understood, and fixable with discovery and a migration.
Shadow AI moves judgement. The employee is not storing the document elsewhere. They are outsourcing the reasoning about the document to a system nobody in the organisation has evaluated, and then acting on the result. The output comes back into a decision, a reply to a customer, a number in a deck, and it carries no marker saying where it came from.
That is why the usual shadow-IT playbook underperforms here. You can find a rogue file share. You cannot find a paragraph of reasoning that arrived in a meeting through somebody’s laptop at half past eleven the night before.
Why blocking makes the problem invisible rather than smaller
Blocking model endpoints at the proxy is the most common first response and the least effective. The work still needs doing, so the behaviour moves to the phone on the desk, which is not on your network and never will be. You have not reduced the exposure. You have deleted your own telemetry about it.
This is the shape of failure I keep running into in review, and it is the same one I wrote about in security controls that fail silently: a control that generates no evidence of being bypassed is indistinguishable, on a dashboard, from a control that works. The proxy block looks green. The traffic went to a mobile network.
There is also a self-inflicted version worth naming. If the sanctioned tool is materially worse than the unsanctioned one, the policy is a tax on doing good work, and the best people pay it least. That is the mechanism behind the 72 percent. They are not wrong about the tool. They are right about the tool and wrong about the risk, which is a much harder problem than ignorance.
What I look for when I review this
When I am asked to look at an organisation’s AI exposure, the policy document is the last thing I read. These questions surface more in an hour than a policy review does in a week:
- Is the sanctioned tool actually good? Not compliant. Good. If the approved option is a generation behind what people can reach in a browser tab, the policy is decoration and the number you are trying to reduce will not move.
- Can you see egress to model endpoints at all? Most organisations cannot tell me how much of last month’s traffic went to AI APIs. If you cannot measure it, every subsequent number in the conversation is a feeling.
- Does the policy distinguish between classes of data, or is it a blanket ban? A blanket ban forces an all-or-nothing choice, and people choose “all” because the task in front of them is real and the rule is abstract. “Never paste customer records” is followable. “Never use AI” is not.
- Is there an amnesty path? If admitting to using an unapproved tool carries any consequence at all, disclosure stops, and your picture of the exposure freezes at whatever you knew before people got cautious.
- Who is the account? The moment an assistant is connected to a mailbox or a repository, it is acting on someone’s credential and inherits their authority, which is the pattern I described in non-human identity sprawl. A personal ChatGPT account is one thing. A personal account with an OAuth grant to the corporate mailbox is an unmanaged privileged identity.
The point where this becomes an incident
Chat is comparatively benign. A person pastes, reads, decides. The exposure is confidentiality, and confidentiality breaches are slow, expensive and survivable.
Shadow AI turns into something else when the chat window becomes an agent. Someone discovers they can connect their assistant to the mailbox, the ticketing system or the code repository, and the paste becomes an action taken automatically on untrusted input. At that moment every finding in the OWASP LLM Top 10 stops being an application-security concern and becomes an operational one, because the model is now a deputy holding real authority and taking instructions from content it was merely supposed to read. That is precisely the confused-deputy problem, running on an identity your IAM team has never seen.
The tool itself is also part of the attack surface, and not hypothetically. I wrote earlier this year about an AI coding tool that turned out to be profiling its users. An employee choosing tools on their own judgement is making a supplier-risk decision with no supplier-risk process behind it.
What I would do in the first thirty days
- Measure before you legislate. Pull DNS and proxy logs for model endpoints and produce one number: what share of staff touched an AI service last month. Do not enforce anything yet. You need the baseline more than you need the win.
- Ship a genuinely good sanctioned option. This is a procurement decision that determines whether every subsequent control works. An adequate approved tool converts most of the 66 percent without any enforcement at all.
- Classify instead of banning. Three tiers is enough: never leaves the building, fine in the approved tool, fine anywhere. People follow rules they can apply without a lawyer.
- Make disclosure free. Say explicitly, in writing, that telling you about a tool you have not approved carries no consequence. Then honour it the first time someone tests it, because everyone will hear about that case.
- Draw the hard line at agents, not at chat. Pasting text into a model is a data-handling question. Granting a model a token to act inside your systems is an access-control question and belongs to the same review as any other privileged access request. The staged approach I set out in the 90-day zero-trust plan applies directly: identity first, then authorisation, then the fun parts.
For German organisations there is a second reason to move on the measurement step, which is that documented control over information flows is exactly what NIS2 assessments ask for, and most of the Mittelstand is still underprepared for that conversation. “We block it” is not an answer that survives a follow-up question about evidence.
The uncomfortable conclusion
The 72 percent are probably right. In a lot of organisations, the person using a model every day genuinely does understand its behaviour better than the committee governing it, because they have thousands of interactions of experience and the committee has a vendor briefing and a risk register.
Being right about the tool does not make them right about the risk. But it does mean the conventional posture, in which the governing body knows best and the user complies, describes a situation that no longer exists. Governance that is slower than the work will be routed around every single time, and the people who route around it most effectively will be the ones you least want to lose.
The task is not to catch them. It is to make the sanctioned path the fast path, and to spend your enforcement budget on the narrow, genuinely dangerous case: a model holding a credential that can act. Everything else is a data-handling problem you can solve by being useful rather than by being strict.
If you want an outside read on where AI is actually being used inside your organisation and which of it constitutes real risk, request a review. I run AI and IT security engagements grounded in enterprise network security, identity and compliance work.