Naming the Thing
Shadow AI is the AI version of Shadow IT, including tools, models, and assistants that employees use to do their jobs without security or IT ever signing off. A marketing staffer running copy through a free chatbot. A developer letting an AI assistant provide code. An analyst feeding a browser extension a stack of records so it can "just summarize this real quick." A meeting bot nobody invited quietly transcribing a call that touched on an active investigation.
Of course none of these users put in a ticket. They don't think of themselves as a security risk, and that is exactly what makes this hard. They were lured by the siren song of AI and assumed they were being more productive.
The Stated Goal vs. The Unstated Goal
Most organizations have technically "addressed" AI by now. The stated goal was "manage the risks of AI in the enterprise", but the unstated goal was "make the scary headline go away and have something to point to on the next audit." So, response probably looked something like this:
- Send a company-wide email banning AI use
- Block a handful of AI domains at your firewall
- Add a blurb to the Acceptable Use Policy that everyone reads (promise)
- Tell your executive team "Yep, we have an AI policy"
- Profit
If you read my Security Theater post, you probably know where this is going. A blanket ban that nobody follows is not a control, it's just Security Theater with an AUP stapled to it. A ban you can't enforce doesn't remove the risk, it just removes your visibility into it. Just like plugging your ears if your kids are screaming, you didn't stop the behavior, just stopped hearing about it.
Desire Paths
Have you ever seen a worn dirt trail cutting diagonally across a lawn? It's the one that appears because the paved sidewalk takes people the long way around. Those are called "Desire Paths". You can put up a "keep off the grass" sign and even lay fresh grass, but it doesn't matter. People will keep taking the shortcut, because the shortcut is faster and they don't care about your landscaping.
Shadow AI is a desire path. Your users have found a route that gets them to the end of their task faster, and they are going to keep walking it. The sign telling them not to won't matter so the question worth asking is not "how do I keep them off the grass?", but is "why is my sidewalk in the wrong place?"
The Scenario: A Helpful Little Python Script
An analyst has a recurring, soul-crushing task: reconciling records between two systems that don't talk to each other. This historically takes hours a week, every week. One afternoon they discover that an AI coding assistant will happily write a script to do the whole thing. They describe the problem, paste in a few sample records so the tool can "understand the mapping," and thirty minutes later they have working code. It runs beautifully and they are thrilled. Through ignorance, they just created some issues:
- A batch of regulated records left your network and landed in a consumer AI tool's context window
- An unreviewed script now runs against a production system of record under the analyst's credentials, most likely without full understanding of what the script is doing
- There is no ticket, no code review, and no logging you would ever stumble across unless you went looking
The user most likely didn't act in bad faith, they solved a real problem that the organization had ignored for years. But that's the tough part: the behavior you want to punish is often just initiative pointed at a gap you left open, grass be damned.
The Risks, Minus the Fear-Mongering
Data leaving your control: This is the big one, especially in regulated environments. Once regulated or confidential data is in someone else's model context, you have lost the chain of custody. You can't prove where it went, whether it was retained, or whether it trained something. For a lot of us, that's a reportable event waiting to happen.
Output you can't trust feeding decisions you can't undo: Models make mistakes. When an AI-generated summary, script, or "analysis" flows straight into a business decision with no human check, you've introduced a source of quiet, confident errors into your process.
Supply chain you never vetted: That slick browser extension or free meeting bot is software you didn't review, granted permissions you didn't scope, phoning home to infrastructure you don't control. Meet the new boss, same as the old boss.
No audit trail: You can't investigate, report on, or improve what you can't see.
So What Do You Actually Do?
Here's the approach I'd take, follow the NIST AI Risk Management Framework (AI 100-1) and its four functions: GOVERN, MAP, MEASURE, and MANAGE. Reasonable people built a reasonable framework here, so why reinvent the wheel?
Get visibility first. You can't govern what you can't see, so start digging. Pull AI tool usage from your egress, your CASB or cloud app discovery, your endpoint telemetry, your DNS logs, and anything else you can think of. Where is everyone actually going? Can you see your desire paths?
Pave the sidewalk. Give people a sanctioned tool with the data protections turned on: an enterprise AI offering that contractually won't train on your data, scoped to your tenant, with logging you own. When you pave the desire path, people will start using it instead of killing a different patch of grass.
Write policy a user can follow. "Don't use AI" fails out of the gate beacuse it's everywhere! What's needed is a document that outlines: "Here's the approved tool, here's what you may put into it, here's what you may not, here's how to ask when you're unsure." This gives people a real path to "yes" and makes it less likely to wear out a dirt path around the policy.
Don't punish the early adopters. This is the same argument I made in Stop Punishing Your Users, and it applies here too (strange, a recurring theme). The employee who found a clever AI shortcut is not necessiarly your problem, but rather a good idicator. They just showed you, for free, exactly where your sanctioned tooling falls short. If you punish that and you don't stop Shadow AI, you just teach people to hide it better. Reward the honesty and you get a reporting culture instead of a concealment one.
Then keep going. My friends have a drinking game for how often I say "continuous improvement," so I'll just pour one for them (cheers, everyone). AI tooling is moving faster than any policy cycle you own. Whatever you write this quarter is like a drawing in the sand, the tide is going to wash it away very soon.
A Final Word for CISOs
If you're a security leader staring down Shadow AI, the tempting question is "how do we block this?" I think that's the wrong question, and it's the one that leads to a policy everyone quietly ignores while the risk keeps compounding out of sight.
The better question is the same one I keep coming back to across all of these posts: what do you actually want here? You don't want zero AI in your environment. That ship sailed, and honestly you probably don't want it back. What you NEED is visibility into where AI touches your data, a sanctioned path that's easier than the shortcut, and a culture where someone tells you about the clever thing they built instead of hiding it.
You can't get any of that by pretending the tools aren't already inside the building. Find the desire paths and help pave the good ones. Stop pretending the AI isn't there, and start governing it.