Blog
Shadow AI in your company: When unchecked AI becomes a risk
Consultant
It’s hard to imagine modern everyday work without artificial intelligence. Current statistics show that the use of AI in certain areas of business has multiplied, and in some cases even increased tenfold, within just a few years. From text generation and code completion to data analysis: AI tools play a significant role in boosting productivity and efficiency. At the same time, however, this development also brings new risks. This includes, in particular, so-called shadow AI, which has serious implications for data security, compliance, and business ethics. This is an issue that is becoming increasingly important for IT administrators and IT managers due to the rapid spread of AI in their everyday work.
What is shadow AI?
The term “shadow AI” was coined directly from the established term “shadow IT.” Employees use AI tools without the IT department’s knowledge or approval.
Tools that are often deployed without sufficient transparency, governance, and control mechanisms from the IT department include, among others:
- Publicly available AI chatbots, such as ChatGPT and Claude, that are used for text, code, or data analysis
- Browser extensions with AI features, such as ChatGPT browser extensions and Grammarly, that access web content directly
- AI-powered SaaS services used without approval from the IT department, such as Notion AI and GitHub Copilot with a private account
- Custom AI scripts and API access with private accounts
Why is shadow AI a critical topic?
Shadow AI is not a fringe phenomenon, but rather a direct result of the rapid adoption of AI. The number of available AI tools is growing exponentially, presenting major challenges for companies. The wide variety of solutions makes uniform standardization difficult and encourages the use of unauthorized tools.
In addition, many employees bring their personal AI accounts into the workplace. A typical example is a personal ChatGPT Pro subscription that is used for professional purposes to gain access to enhanced features. The lines between personal and business use are becoming blurred, which poses significant risks to data protection and compliance.
Another critical factor is that many companies still lack a clear AI governance strategy. The lack of policies, controls, and technical safeguards allows for the unchecked use of AI tools. The risk of data leaks and unauthorized data processing is growing significantly.
At the same time, pressure is mounting due to regulatory requirements such as NIS2 and the EU AI Act. They explicitly demand more transparency, oversight, and risk assessment in the use of AI.
Furthermore, studies by Microsoft show that it is precisely this unregulated use that is making companies and public institutions increasingly vulnerable.
A survey commissioned by Microsoft shows that the use of shadow AI is widespread in companies and, in particular, in public institutions. The results make it clear that a lack of governance, insufficient transparency, and inadequate safeguards significantly increase the risk of attack. As a result, organizations are becoming increasingly vulnerable to security incidents, data breaches, and compliance violations.
The fundamental risks of shadow AI
1. Data leakage into unchecked data environments
- Information entered into AI tools can be stored or processed further
- Sensitive corporate or personal data leaves controlled environments
- Loss of intellectual property and confidential information
2. Security gaps
- Integration of insecure APIs or those provided by third parties using AI tools
- Lack of transparency regarding training and processing mechanisms
- A potential gateway for malware and data misuse
3. GDPR and compliance risks
- Use of AI tools that are not in compliance with GDPR
- Storage or processing of data outside of the EU
4. Lack of governance and traceability
- No central oversight of AI usage
- No auditing or testing paths
- Challenges in responding to incidents during an emergency
Solution approaches and best practices
1. Create transparency
The first and most important step in dealing with shadow AI is to ensure transparency. Companies need to understand which AI tools are being used, by which users, and in what ways.
Traditional, network-based security solutions such as proxy servers, secure web gateways, or platforms like Zscaler are well-suited for identifying and classifying AI-related traffic.
Within the Microsoft ecosystem, there are several built-in options for making AI use visible across the entire company:
- Microsoft Defender for Cloud Apps (MDCA) offers Cloud Discovery, a feature that allows you to identify and assess the AI services used by corporate devices.
- The Microsoft Defender Suite also analyzes endpoint signals and helps to identify AI traffic directly on managed devices.
- In addition, Microsoft Shadow AI Discovery and Microsoft Entra Internet Access offer advanced application insights and analytics that allow for a detailed analysis of GenAI and cloud app usage.
The goal of this phase is to gain a complete picture of the situation. The point is not to immediately block the use of AI.
2. Establish governance
Based on the transparency that has been achieved, the next step is to establish a clear AI governance framework. This includes defining a company-wide AI strategy that takes both innovation and security into account.
Central elements include:
- Defining approved AI tools
- Introducing allow and block lists for AI applications
- Clear policies on using AI and processing data
- Regular review and adjustment of the policies
Effective governance prevents uncontrolled growth without unnecessarily limiting employees’ productivity.
3. Effective protection of data
Protecting sensitive corporate data is a critical factor in the secure use of AI. Microsoft provides comprehensive features for this purpose through the Microsoft Purview Suite that prevent data leakage and ensure compliance with regulatory requirements.
These include:
- Data Loss Prevention (DLP) policies for Microsoft Copilot, enterprise AI, and third-party AI to prevent sensitive data leaks
- Data classification and sensitivity labels to embed protective measures directly into the data itself
- Endpoint DLP to control the processing and sharing of sensitive data in AI tools
Additional features such as Insider Risk Management, Communication Compliance, and Data Security Posture Management (DSPM) help to identify risky AI usage early on and consistently implement compliance requirements.
Structured shadow AI strategy according to Microsoft
1. Identify AI apps
The first step is to systematically identify and monitor the use of AI:
- AI discovery and monitoring with Microsoft Defender for Cloud Apps
- DSPM for AI to identify AI interactions with sensitive data
- Insider Risk Management to detect potentially risky or non-compliant AI usage at an early stage
This phase lays the groundwork for well-informed decisions.
2. Block unauthorized AI apps
Once it is clear which tools are being used, unauthorized AI applications can be specifically restricted or blocked:
- MDCA to block access to unauthorized AI services
- Microsoft Entra Internet Access for role- or group-based access controls
- Microsoft Intune to prevent the installation of unauthorized AI apps on managed devices
This is an effective way to reduce shadow AI.
3. Protect sensitive data in authorized AI apps
Even with approved AI tools, it is essential to ensure that sensitive data stays protected:
- Use of sensitivity labels to classify and protect confidential information
- Endpoint DLP to prevent unintended data processing or disclosure by AI applications
The focus here is on controlled use rather than blanket restrictions.
4. Management and traceability
In the final step, the use of AI is managed for the long term and documented in an audit-proof manner:
- Communication compliance to detect misconduct or rule violations in the context of AI
- Data lifecycle management, for example, to store or delete older prompts
- eDiscovery to analyze AI interactions as part of audits or investigations
These measures ensure transparency, traceability, and regulatory certainty.
How we help companies implement AI security and governance
Implementing an effective shadow AI strategy requires more than just individual technical measures. Transparency, governance, and data security must be considered as a whole and integrated into existing processes. That is exactly where we support companies with targeted consulting and enablement programs.
The Skaylink workshops on Microsoft Purview Suite are a key component. In these, we work together to:
- Identify existing data sets and sensitive information,
- Establish data classification and sensitivity labels in a meaningful way,
- Design DLP scenarios for Copilot, Enterprise AI, and third-party AI,
- Create monitoring and auditing capabilities, and
- Implement compliance and governance requirements in a practical manner.
Furthermore, we offer Copilot AI security assessments to identify risks early on and enable the secure, controlled use of AI. This focuses on both technical aspects and organizational issues. The discussion will cover roles, guidelines, and responsibilities, as well as the strategy for deploying AI agents and their governance, among other things.
As part of our data security engagements, we help to:
- Make shadow AI visible,
- Develop a sustainable AI strategy,
- Build governance structures, and
- Address regulatory requirements such as the EU AI Act, GDPR, and NIS2.
The goal is to not only curb shadow AI in the short term, but also to create AI scenarios that are permanently controlled, secure, and compliant. This is the only way to use AI productively in a business without compromising security and control.
You might also like
- White papers
- Blog
