Shadow AI in the Enterprise

Key takeaways

• ✓Shadow AI, meaning AI tools employees use without IT approval, is widespread in Australian enterprises and largely invisible to the teams responsible for managing risk.

• ✓The most common discovery methods combine browser/SaaS visibility tooling, expense report audits, and direct conversation with team leads, not technical monitoring alone.

• ✓Free-tier consumer tools (ChatGPT's unpaid plan, free Gemini, browser-based AI extensions) carry the highest data exposure risk because they typically train on user inputs by default.

• ✓Finding unsanctioned tools is only half the job. The response that works is a fast-track approval path alongside clear policy, not a blanket ban that drives usage further underground.

• ✓Governance without training fails. Staff who understand why a tool is risky make better decisions than staff who have simply been told what is prohibited.

What is shadow AI in an enterprise context?

Shadow AI refers to the use of AI-powered tools by employees without the knowledge, approval, or oversight of IT or security teams. It is a subset of shadow IT (unauthorised software and services generally), but it carries a distinct set of risks because AI tools process, generate, and in many cases retain the data you feed them.

The difference matters. A rogue SaaS project management tool might sit outside your procurement process, but it is unlikely to ingest a draft acquisition proposal or a client's medical records and use that data to train a third-party model. Many consumer and prosumer AI tools do exactly that by default, unless enterprise data controls are explicitly enabled.

Shadow AI accelerated sharply from late 2022 onwards, when capable, free-to-use large language models became available to anyone with a browser. By mid-2023, tools like ChatGPT, Claude, Gemini, Perplexity, and dozens of AI writing and coding assistants were embedded in everyday workflows, mostly without IT's knowledge. The tools are genuinely useful, the sign-up friction is low, and employees rarely intend harm. They are simply trying to do their jobs faster.

That context matters for how you respond. Shadow AI is not primarily a discipline problem. It is a governance gap: the organisation has not given people sanctioned, capable tools, clear policies, or enough training to know what is and is not safe. The gap gets filled by whatever works.

Shadow AI is a governance gap, not a behaviour problem

When employees reach for unsanctioned AI tools, it usually means the organisation has not supplied adequate alternatives or made the risks legible. Treat the detection exercise as a diagnostic, not an investigation.

There is also a spectrum. At one end, an employee using a free AI image generator to tidy up a presentation is a low-stakes policy question. At the other end, a finance analyst pasting customer account data into an unreviewed chatbot to summarise a report is a potential Privacy Act exposure. The challenge for CISOs and IT leaders is that both behaviours look identical from the outside until you go looking.

Why does shadow AI spread so quickly?

The honest answer is that most shadow AI isn't driven by recklessness. It's driven by people trying to do their jobs faster, hitting friction, and finding a workaround.

The pattern is familiar to anyone who watched shadow IT emerge in the early cloud era. A formal software request takes weeks to approve. The free version of an AI writing tool is available right now, requires nothing more than an email address, and demonstrably cuts an hour of work down to ten minutes. The choice your employee actually faces isn't "sanctioned AI versus unsanctioned AI". It's "unsanctioned AI versus no AI at all, while the person at the next desk is already three times as productive".

Approval friction compounds the problem. Many enterprise procurement processes were designed for annual software contracts, not for tools that cost nothing to trial and are updated weekly. When the approval path is long and the tool is free, most people don't wait.

Free-tier products are particularly effective at seeding adoption at scale. A single enthusiastic team member discovers a tool, shares it in a chat channel, and within a fortnight a dozen colleagues are using it, none of whom have thought carefully about where their prompts are being sent or how the vendor's data retention policy interacts with your obligations under the Privacy Act.

Productivity pressure makes this worse. When a manager is pushing for a deliverable and an AI tool will help hit the deadline, the data-handling question rarely surfaces. That's not laziness; it's normal human prioritisation under time pressure.

The free-tier risk is structural, not behavioural

Free AI tools often come with terms that allow the vendor to use submitted content to train their models. Employees don't read those terms, and even if they did, most wouldn't know whether the content they're pasting constitutes personal information under Australian privacy law. The risk isn't that your people are careless. The risk is that the system makes the unsafe choice the easy one.

The result is that by the time a CISO or IT leader becomes aware of the problem, the tools are already embedded in workflows. That's why finding them quickly matters.

How do you find out what tools your team is actually using?

Detection starts with the data you already have. Most organisations don't need to buy new tooling to surface shadow AI; they need to look more carefully at what their existing systems are already recording.

Network and proxy logs

Your web proxy or firewall logs every domain your devices contact. Run a query for well-known AI endpoints: openai.com, claude.ai, gemini.google.com, perplexity.ai, character.ai, and the API subdomains for each. Volume matters as much as presence. A single hit on claude.ai might be a curious employee testing a tool once. Fifty hits a day from the same user, sustained over three weeks, suggests it is embedded in their workflow.

If you use a cloud access security broker (CASB), a tool that sits between users and cloud services to enforce policy, most will now auto-categorise AI tools as a distinct application class. Check whether yours does, and whether the category is being monitored.

SSO gap analysis

Single sign-on (SSO) is the clearest signal of which tools are sanctioned. If a tool is not in your identity provider, employees are authenticating with personal credentials, which means you have no visibility into what data is passing through it and no way to revoke access when someone leaves.

Pull a list of every application connected to your SSO. Then compare it to what your proxy logs show employees actually visiting. The gap between those two lists is your shadow AI inventory.

The SSO gap is your fastest audit

Any AI tool appearing in your proxy logs but absent from your identity provider is operating entirely outside your control. You cannot see what it receives, and you cannot turn it off.

Expense reports and procurement cards

Browser-based AI tools often start free and then convert to paid subscriptions. When an employee upgrades, they frequently put it on a corporate card or submit it for reimbursement. A simple search of your expense management system for common AI vendor names, or for subscription charges in the $20 to $50 AUD per month range from unfamiliar SaaS vendors, will surface tools that never went through procurement.

This is worth running quarterly. The pattern to look for is recurring small charges from vendors your IT team has never heard of.

Browser extension audits

This one is frequently overlooked. AI tools increasingly arrive as browser extensions rather than websites, which means they may not appear prominently in proxy logs. Extensions like AI writing assistants, grammar tools with built-in AI, and meeting summarisers can read page content, clipboard data, and in some cases form fields.

If your devices are managed through a mobile device management (MDM) platform or group policy, you can pull an inventory of installed extensions across your fleet. Flag anything that requests permissions to "read and change all your data on websites you visit," which is the standard permission string for extensions that can observe browser activity. That category warrants individual review.

Surveys and direct conversation

The methods above find tools. They don't tell you why people are using them or what problems those tools are solving. A short, anonymous survey asking teams what AI tools they use in a typical week, and what tasks they are applying them to, will surface things that never touch your network because employees are using personal devices or home internet connections.

Frame this as a needs assessment, not an audit. People are more forthcoming when they believe the outcome is better tooling rather than a policy crackdown. And practically speaking, the information is more useful that way. If twenty people in your legal team are using the same unsanctioned summarisation tool, the right response is probably to evaluate a sanctioned alternative, not to send twenty disciplinary emails.

Understanding why tools spread is covered in more detail in the four AI risks every board should be asking about. The short version: people use unsanctioned tools because sanctioned ones are slower, harder to access, or simply don't exist yet.

Which shadow AI tools carry the most risk?

Not all unsanctioned tools are equally dangerous. The risk depends on what data gets sent to the tool, how that data is handled on the other end, and whether the vendor's terms of service give them rights to use it for model training.

Here is a practical risk tier across the most common categories.

Consumer chatbots (ChatGPT free, Claude.ai free, Gemini free)

These are the most widely used shadow AI tools in Australian workplaces, and the risk varies significantly by plan. Free-tier accounts on most platforms default to using conversation data for model improvement unless users opt out, which most employees never do. The practical implication: a staff member who pastes a client brief, a contract summary, or internal financial data into a free ChatGPT session may be contributing that content to training data.

The paid and enterprise tiers of these tools operate under different terms. If your organisation has a ChatGPT Enterprise agreement, for example, your data is not used for training. But that protection only applies to users on the enterprise account. Anyone using their personal account alongside it is not covered.

Browser extensions

This category is probably the least visible and the most underestimated. AI-powered writing assistants, grammar tools, meeting summarisers, and email helpers often run as browser extensions. They may have permission to read every page you visit, every email you draft, and every document you open in a browser tab.

The permissions model for browser extensions is poorly understood by most users. Many extensions request broad access during installation, users click through without reading, and the extension developer may have no meaningful security posture at all. Some of the riskiest tools your team is using will never appear in a web proxy log because the data leaves through the extension, not a direct site visit.

Code assistants

GitHub Copilot, Tabnine, and similar tools sit directly inside a developer's code editor. When a developer accepts a suggestion or triggers a completion, the tool typically sends surrounding code as context to a remote model. Depending on the tool and the configuration, that context may include API keys, database credentials, internal logic, or proprietary algorithms.

For teams building in regulated environments, such as financial services or healthcare, this is a material risk. Code that includes client identifiers or business logic falls under the same obligations as any other sensitive data. The data leakage scenarios worth reading alongside this section cover this in more detail.

Image and video generators

Tools like Midjourney, Adobe Firefly (personal accounts), and consumer video generators carry a different risk profile. The primary exposure here is intellectual property and brand integrity, rather than data privacy. An employee generating marketing imagery, product mockups, or presentation visuals through a personal account may be assigning the output's IP rights to the platform, not to your organisation. Some platforms retain rights to user-uploaded reference images, which could include confidential product designs or unreleased campaign assets.

There is also a reputational risk. AI-generated imagery created outside any brand or legal review process can find its way into client-facing materials before anyone with authority has seen it.

The risk is in the data, not just the tool

The same tool can be low-risk or high-risk depending entirely on what data flows through it. A developer using a code assistant on an open-source hobby project is not the same risk as the same developer using it on proprietary production code. Assess the data, not just the product name.

What should you do once you find unsanctioned tools?

The worst response to discovering shadow AI is a blanket ban. It signals to capable staff that the organisation is an obstacle rather than a partner, and it drives usage underground where you have even less visibility. The goal is a triage process, not a crackdown.

Sort what you find into three categories.

Ban outright. A small number of tools genuinely warrant immediate blocking. These are tools with no enterprise tier, no data processing agreement, explicit terms that allow training on user inputs, or a track record of security incidents. Free-tier consumer tools being used to process client data or personal information fall into this bucket. Act quickly, communicate the reason clearly, and offer an alternative in the same message. A ban with no explanation breeds resentment; a ban with a reason and a replacement builds trust.

Monitor and assess. Most tools sit in a grey zone. The underlying capability may be legitimate, the risk may be low, or the use case may be narrow enough that harm is unlikely. Put these tools on a watch list, note which teams are using them and for what, and set a review date. This is also where you gather the information you need to make a proper decision rather than a reactive one.

Fast-track to sanctioned status. Some tools your team has adopted are genuinely good. If a tool has an enterprise tier with appropriate data handling controls, a DPA available on request, and a real security posture, the right move is often to negotiate an enterprise agreement and bring it inside the governance boundary. This is how shadow AI becomes managed AI. It rewards the people who found something useful, and it gives you the oversight you need.

The blanket-ban trap

Blocking every unsanctioned tool without offering alternatives does not eliminate shadow AI. It makes it invisible. Employees who need to get work done will find another way; you will just lose the ability to see what they are doing.

Once you have sorted your tools, the next step is policy. An AI acceptable use policy gives staff a clear framework for what they can and cannot do without waiting for IT to approve each tool individually. Done well, it reduces the volume of shadow AI by removing the ambiguity that causes it. When people know what is permitted and what the rationale is, they are far less likely to reach for something unsanctioned.

A few practical points on execution. Communicate decisions by team, not in a company-wide broadcast. A message to a marketing team about their specific tools lands very differently from a generic policy email nobody reads. Involve team leads in the triage conversations so the response does not feel like it is coming from somewhere above and outside. And revisit your findings every quarter. The tool landscape moves fast, and a tool you assessed as low risk six months ago may have changed its terms or been acquired.

The broader context matters here too. Shadow AI rarely appears because staff are careless. It appears because approved tools are slow to procure, inadequate for the task, or simply unknown to the people who need them. If your discovery process surfaces a pattern, for instance, most of the tools are in the same category or used by the same function, that is a signal worth acting on. The right long-term fix is an enterprise AI platform that actually meets the needs driving the shadow usage in the first place. That is a procurement and governance conversation, and it is a better use of your energy than fighting the same tools again next quarter.

Frequently asked questions

How common is shadow AI use in Australian enterprises?

Shadow AI is widespread, though precise figures are hard to pin down because unsanctioned tools are, by definition, undercounted. Research from multiple workforce surveys consistently finds that a substantial majority of knowledge workers have used an AI tool not provided by their employer. The more relevant question for most IT teams is not whether shadow AI is present, but how much, and in which parts of the business.

Is shadow AI always a security risk, or only in certain situations?

The risk depends on what data employees are sharing with the tool, and how that tool handles it. A team member using a free AI assistant to rephrase a generic email is very different from a finance analyst pasting customer payment data into an unapproved chatbot. The data leakage scenarios that matter most involve personally identifiable information, confidential client data, unreleased financial results, or proprietary process documentation. Tools that train on user inputs by default carry significantly higher risk than enterprise-licensed versions of the same product.

Can my existing DLP tools detect shadow AI use?

Partially. Data loss prevention (DLP) tools can flag known AI domains or detect unusual data transfers, but they were not designed with AI-specific workflows in mind. Many shadow AI tools use HTTPS, which means content inspection requires SSL decryption to be enabled. Browser-based tools are especially hard to monitor without endpoint agents. DLP is a useful layer, but it works best alongside a CASB (Cloud Access Security Broker) and a clear acceptable use policy that employees have actually read.

What if employees push back on AI tool restrictions?

Pushback usually signals that the sanctioned tools are not meeting a real workflow need. Before blocking access or issuing policy, it is worth understanding what employees are trying to accomplish. If a team is using an unsanctioned summarisation tool because their approved platform does not support that function, the answer is probably a better tool, not a prohibition. Governance works better when it channels behaviour rather than simply suppresses it. An AI acceptable use policy that explains the reasoning behind restrictions tends to get more genuine compliance than one that only issues rules.

How often should we repeat a shadow AI audit?

At minimum, once a year, but quarterly reviews are more realistic given the pace at which new AI tools reach the market. A new category of AI capability can go from niche experiment to mainstream adoption in a matter of months. Set a standing agenda item for your security review cycle, and treat shadow AI discovery as an ongoing posture rather than a one-time project.

Ready to build AI governance that actually works?

Shadow AI rarely stays contained on its own. Without a clear policy, visible sanctioned alternatives, and staff who understand why the guardrails exist, the same tools will keep reappearing under different names.

Trying to get your AI governance off the ground?

We work with security and IT leaders to design practical AI governance programs, including acceptable use policies, discovery approaches, and staff training that actually changes behaviour. You'll leave with a clear next step, not a slide deck.

Book a 30-minute discovery call →

For a broader view of where shadow AI sits inside your organisation's overall risk picture, the AI risk, governance and scams pillar hub is a good place to start.