Forty seconds nobody notices
Tuesday morning, 8:40 a.m. A key account manager has a quarterly review at 11 and nothing prepared.
He opens the Excel sheet with 340 existing customers: company name, contact person, mobile number, discount tier, contract term, notice period. Then a browser tab with a free AI chatbot, on a personal account, signed in with his Gmail address. Ctrl+A, Ctrl+C, Ctrl+V.
"Summarize the top ten customers by revenue potential and give me three talking points for each one."
Forty seconds later, he has a usable briefing. The meeting goes well. What actually happened technically in those forty seconds, nobody in the company knows. The data now potentially sits on a server outside the EU. The firewall saw an HTTPS connection to a popular web service, just like 4,000 others that morning. No alert, no ticket, no log entry that catches anyone's eye.
Seven months later, a customer asks the head of sales how a competitor knows their pricing terms. Now the search begins. And IT realizes it can't even say which AI tools are being used in the company, let alone who entered what, and when.
The most pressing AI risk for mid-sized companies is an employee's copy-paste into a tool nobody knows exists.
What is shadow AI?
Shadow AI refers to any use of AI services in a work context that hasn't been reviewed, approved, and inventoried by IT or information security. That ranges from a personal ChatGPT tab to browser extensions with summarization features, to models installed locally on a company laptop, to AI plugins. If you want to test your AI security, you first need to know which AI is actually running in your organization. And that's exactly where most companies' knowledge runs out.
The numbers are clear. 71 percent of employees at German companies use AI tools that nobody provided to them. The reason they gave: the pace and volume of their workload. The Microsoft Work Trend Index 2025 puts the global figure at 78 percent of AI users bringing their own tools. This is the norm, not the behavior of a few rogue outliers.
Why your existing IT audits won't find any of this
In its guidance on AI security, Germany's Federal Office for Information Security (BSI) points out that existing standards for traditional IT systems can't simply be applied to modern AI systems because of their particular structure. In practice, that means an ISO 27001 audit checks whether you have a policy. It doesn't check whether 40 employees work around it every day. Vulnerability scanners look for CVEs, not behavioral patterns. And a SIEM trained on malware signatures and lateral movement sees absolutely nothing unusual in a TLS connection to an AI endpoint.
According to a 2025 KPMG survey, 52 percent of organizations have no formal policy at all on using external AI tools, and only 29 percent have ever checked their actual AI use against the regulatory frameworks that apply to them. So most companies have neither rules nor measurement – just hope.
1. One had it check sensitive database source code for bugs
2. A second asked it to optimize code
3. A third fed in the transcript of an internal meeting and had it generate minutes
Samsung responded with internal usage restrictions – after the data was already out. Worth noting: this was approved use.
How data leaks out unnoticed
The sequence is the same in every company, and it has nothing to do with malice. It has to do with deadlines.
Step 5 is the one that matters. With a ransomware attack, you know something has happened by the time production grinds to a halt at the latest. With shadow AI, that moment never comes. The organization finds out by chance, through an audit report, through a data subject request – or through a customer asking how their pricing terms ended up outside the company.
The IBM Cost of a Data Breach Report 2025 shows that this risk is measurably more expensive than sanctioned AI use: incidents involving shadow AI cost an average of $4.63 million, compared with $3.96 million for approved AI systems – a premium of roughly $670,000 per incident.
The three misconceptions that cloud your view
- Security leaders suspect that banned tools are being used anyway
- Without a practical alternative, a ban only drives usage underground – it doesn't reduce it
- Hidden usage is harder to document than open usage
- Prompt injection is real – but it only affects those who run their own AI
- The documented main source of risk is data entered into third-party services
- The two require different testing methods
- The 71 percent figure from Germany was collected across all industries
- Mid-sized companies typically have less discovery tooling, not more
- Customer data isn't any less subject to regulation just because the company is smaller
Shadow AI as a compliance risk
Shadow AI is also a compliance problem with real consequences. If customer or employee data is entered into an AI service without a legal basis, without purpose limitation, and without a data processing agreement, that may well be a reportable GDPR violation.
The Italian Garante showed on March 30, 2023, that regulators are prepared to crack down on generative AI: in an emergency order, it required OpenAI to immediately stop processing the personal data of Italian users, citing among other things the lack of a legal basis. Other European authorities followed up with inquiries of their own.
By 2030, more than 40 percent of organizations worldwide are expected to suffer security or compliance incidents caused by unauthorized AI tools.
Measure your exposure instead of guessing
The order matters. If you start with the policy, you're writing a document against a phenomenon whose scale you don't know. If you start with measurement, two weeks later you'll have a list of tool names, user counts, and data categories – and you can derive a policy from it that actually fits reality.
- Two-week measurement: Match proxy, DNS, and firewall logs against a list of known AI endpoints. The result: tool names, number of users, volume – your first reliable figure.
- Define risk classes: Which data must never leave (customer data, contract terms, source code, HR data), and which is non-critical (public marketing copy, help with wording)?
- Document training: Attendee lists, content, dates. Without proof, the measure doesn't exist as far as a regulator is concerned. Hands-on security awareness formats work far better here than a generic click-through video.
- Verify technically: If you run your own AI systems, chatbots, or agents, you also need a dedicated technical assessment of those AI systems – because prompt injection and shadow AI are two different risks that call for two different testing methods.
Frequently asked questions
How do I find out which AI tools my employees are using?
The most reliable method combines three data sources: CASB or SaaS discovery for known cloud AI services and OAuth connections; analysis of proxy and DNS logs for connections to known generative AI API endpoints; and an audit of issued OAuth tokens and API keys in Microsoft 365 or Google Workspace. CASB alone isn't enough, because it often misses locally installed models, browser extensions, and personal accounts on company devices.
Is it a GDPR violation when employees enter customer data into ChatGPT?
If personal data is entered into an external AI service without a legal basis, without purpose limitation, and without a data processing agreement, that may well constitute a reportable violation.
Is banning AI tools in the IT policy enough?
No. A ban without a practical, approved alternative just pushes usage out of sight, which makes it harder to investigate an incident later on.
How much does a shadow AI incident cost compared with other data breaches?
According to the IBM Cost of a Data Breach Report 2025, data breaches involving shadow AI cost an average of $4.63 million. Shadow AI incidents accounted for 20 percent of all breaches analyzed.
Conclusion: If you don't measure, you can't assess
In many companies, the conversation about AI security revolves around prompt injection, jailbreaks, and agentic AI. Those are real attack surfaces, but only for organizations that run their own AI systems. The attack surface everyone has is an employee's browser tab, where a customer list gets pasted at 8:40 a.m. because something is due at 11.
What separates companies that have this risk under control from those that don't is rarely the quality of their policy. It's whether anyone in the organization can give a reliable number: how many AI services are in use, by how many accounts, with which categories of data. Without that number, you can't assess the risk.
And measuring isn't a major project. It's an analysis of the logs you already have, a token audit, and an honest conversation with sales and engineering.
- Measure before you regulate: Two weeks of log analysis beats any policy built on assumptions.
- Alternatives before bans: Without an approved tool that gets the job done, you're just pushing the problem out of sight.
- Test repeatedly: Every new generation of tools creates new shadow AI; a one-time audit is outdated within a quarter.
- LLM Pentesting & AI Security: Prompt Injection, Jailbreaks, and Agentic AI – the other half of AI risk: your own systems
- Why certifications (ISO, SOC 2) don't mean you're secure – audit evidence versus actual exposure
Do you know what your employees uploaded this morning?
We assess your AI systems and data flows using realistic attack scenarios – and uncover the entry points that are still wide open.
Request an initial consultation →
