Shadow AI is no longer a hypothetical on your risk register. The share of security incidents involving shadow AI more than doubled year over year to 43 percent in IBM’s 2026 breach study, and the 2025 edition had already shown organizations with high levels of unsanctioned AI paying an extra $670,000 over the average incident. On September 24 we published a piece arguing that an AI policy without controls is paper. This is the companion for the harder half, the controls, because governing AI your employees adopted without asking is mostly a discovery and incentive problem, and both halves are solvable with things you already own.
We should also say why the timing matters. The 2026 breach numbers put the global average at $4.99 million with AI-driven attacks up 56 percent, which means ungoverned AI is now exposure on both sides of the ledger, the data your people leak out and the attack surface you cannot see.
The ban failed, and the numbers say so
Start with the most useful dataset on actual behavior. Netskope’s Cloud and Threat Report 2026, built on telemetry from October 2024 through October 2025, found 47 percent of generative AI users still on personal accounts at work, outside any organizational oversight. The same report counts an average of 223 incidents per month, per company, of users sending sensitive data to AI apps, a figure that doubled year over year.
And yet the trend inside those numbers is the real story. Personal-account usage fell from 78 percent a year earlier, while company-approved account adoption rose from 25 percent to 62 percent. Employees did not stop wanting AI. They moved to sanctioned tools where sanctioned tools existed. That is the entire governance thesis in one data point, and it is why we tell clients the goal is not to win a blocking war. It is to make the governed path the path of least resistance, then watch the two numbers that matter.
You cannot govern what you have not found
Every shadow AI conversation we have starts the same way, with a leader confident their organization uses a handful of AI tools, and an inventory that says otherwise. Discovery is not exotic. Your web proxy or secure gateway already categorizes AI destinations. Your identity provider’s logs show OAuth grants to AI services that employees approved themselves, the same consent mechanism we flagged in our non-human identity post. Expense reports show personal AI subscriptions being reimbursed. Browser extension inventories show AI assistants reading every page. None of this needs new spend to start, and the SaaS-discovery and AI-governance product category can extend it later if the scale demands, evaluate those as options rather than answers.
The trap worth naming is embedded AI. Blocking chatgpt.com does nothing about the assistant that ships inside your CRM, your meeting tool or your office suite, which is precisely where usage goes when the front door is locked. Discovery has to enumerate features inside sanctioned SaaS, not just destinations on the network, or your inventory flatters you.
Sanction, tolerate or block, and let data decide, not brands
Once you can see usage, resist the instinct to rule on tools. Rule on data. A marketing team drafting campaign copy in a consumer chatbot and an engineer pasting proprietary source into the same chatbot are different risks wearing the same logo. IBM’s 2025 data makes the stakes concrete, since shadow-AI breaches disproportionately exposed customer personal data and intellectual property, 65 and 40 percent respectively.
So the triage we recommend is three buckets, applied per use case. Sanction it, by providing an enterprise account behind SSO with data controls, when the use case touches nothing sensitive or the enterprise tier can protect what it touches. Tolerate it with guardrails when the risk is modest and the productivity is real. Block it only when the data classification demands it, and say why in the policy, because unexplained blocks are how you got 47 percent personal-account usage in the first place. The offensive AI economics sharpen the block bucket, since stolen AI credentials now serve attackers as loot, compute and cover.
Shadow AI governance is an owner and two numbers
Here is our position, stated plainly. Shadow AI governance fails as a committee topic and works as an owned metric. Name one owner, give them the discovery inventory, and have them report two numbers monthly, the share of AI usage on personal accounts and the count of sensitive-data incidents involving AI apps. Netskope’s telemetry makes both benchmarkable against industry movement, 47 percent and 223 per month are the current averages, and both numbers falling is the only honest definition of progress. Everything else, the policy text, the training deck, the tool catalog, exists to move those two numbers. This is the operating model we build in our AI governance and assurance work, and it is deliberately boring, because boring is what survives quarter after quarter.
What to ask your team this week
- Show me last month’s inventory of AI destinations and embedded AI features in use, with the discovery source for each. No inventory means governance has not started.
- What share of our generative AI usage runs through accounts we manage? If nobody can answer, the proxy and SSO logs can, this week.
- Which three shadow AI use cases have the most users, and what would sanctioning each one cost? Demand is data.
- Who owns the two numbers, personal-account share and AI data incidents, and when did they last report them?
- Which blocks are we enforcing without a written data-classification reason? Each one is pushing usage somewhere you cannot see.
Bottom line
Discover with the telemetry you already have, sanction the demand you find, block only what data classification justifies, and put one owner on two monthly numbers. Shadow AI shrinks when the governed path is the easy path. The breach data says every other approach is just deferred cost.