Shadow AI: Start With Visibility, Not Policy

Most teams do not know what AI tools their employees are using right now.

That is not a criticism. It is a description of the problem.

The Numbers Make This Real

• 98% of organizations have employees using unsanctioned AI tools.
• 78% of employees bring their own AI tools to work.
• Only 12% of companies can detect all Shadow AI usage.
• IT can see less than 11% of the AI applications running in their environment.
• $670,000 extra per breach when Shadow AI is involved, according to IBM data.
• 65% of Shadow AI breaches expose PII.

These are not edge cases. This is the normal state of most organizations right now.

Why the Ban Approach Fails

In 2023, Samsung engineers pasted confidential semiconductor source code into ChatGPT to debug a problem. They were trying to work faster. They were not trying to leak data. OpenAI retained that input and it entered their training pipeline.

Samsung responded with restrictions. The employees were not malicious. The risk was entirely real.

The uncomfortable pattern: when you ban a tool people have integrated into their workflow, they do not stop using AI. They use it less visibly. 46% of employees say they would keep using AI even if banned.

You cannot discipline your way to governance. The employees are not the problem. The information gap is the problem.

The 89% Solution

Unauthorized AI usage drops 89% when organizations provide approved alternatives that actually work for employee needs.

That is the leverage point. Not prohibition. Making the right path better than the wrong path.

This is the FORGE Guardrails insight. But Guardrails cannot exist without Baseline. The inventory of what is actually running in your environment comes first.

FORGE Baseline: Visibility Before Policy

Step 1: See What Is Running

You cannot govern what you cannot see. Run a SaaS discovery scan. Check your CASB logs. Pull the Okta Agent Discovery report if you have one. The goal is an honest inventory, not a complete one. Start with what you can find.

Most organizations find 3-5x more AI tools in use than their IT team knew about. That gap is the starting point.

Step 2: Classify the Risk

Not all AI tools are the same risk. Segment them by what they process:

• High risk: Tools that see customer data, PII, financials, or proprietary code.
• Medium risk: Tools that process internal documents, meeting notes, or communications.
• Low risk: Tools that assist with writing, formatting, or personal productivity without accessing sensitive data.

Three tiers is enough. You can subdivide later.

Step 3: Steer, Not Block

For each high-risk use case, identify one approved tool that actually works. The approved tool has to be genuinely good. If it is slower, harder, or worse than the unauthorized option, people will route around it.

Steering means: here is the tool that meets your need, here is how to use it securely, here is what data you should never put in it.

Step 4: Build Sustain

Shadow AI is not a one-time audit. It is a recurring operational reality. Integrate exception logging into your existing IT request process. When someone asks for a new AI tool, that is a governance touchpoint, not an annoyance.

Run a quarterly check on your SaaS discovery. Review the exception log for patterns. Update your approved tool list when the landscape changes.

What This Looks Like in Practice

A 150-person logistics company came to this problem through an incident. Someone had uploaded a customer list to an AI writing tool to generate form letters. The customer list included home addresses. Nobody had approved that tool. Nobody had told that employee it was risky. The employee just wanted to work faster.

The fix was not discipline. It was three things:

1. A five-minute conversation with the team about what they were trying to accomplish with AI.
2. An approved alternative that was actually faster than what they had been using.
3. A simple shared document listing the three categories of data that should never go into any AI tool.

Unauthorized usage dropped. Incidents stopped. Nobody had to ban anything.

The Starting Point

If you are reading this and thinking about your own organization:

Do not start with a policy. Start with a scan.

Know what is running. Know what your team is trying to accomplish. Then build the governance that serves those goals instead of fighting them.

The FORGE AI Workflow Starter Kit includes the baseline inventory template, a skills capture format for documenting approved workflows, and a guardrails checklist for the high-risk inputs that apply across your whole team.

Get the FORGE AI Workflow Starter Kit - free, no fluff.

Shadow AI is a visibility problem before it is a policy problem. FORGE Baseline gives you the starting point: see what is running, understand what your team needs, and build governance that actually works.