01865 595510 Get a gap analysis

Ai

TEST – Shadow AI is already in your business. Here’s how to make it safe

4 min read

Your people are already using AI. They’re drafting emails in ChatGPT, summarising contracts in Gemini and pasting spreadsheets into whatever chatbot gets the job done fastest. Most of them aren’t doing anything malicious. They’re trying to work quicker. The question isn’t whether AI is in your business. It’s whether you can see it, and whether you’ve decided what’s allowed.

The threat picture hasn’t gone away

Before looking at AI itself, it’s worth remembering the baseline. The UK Government’s Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses suffered a breach or cyber attack in the past year, rising to 69% of large firms. Phishing remains the most common incident, hitting 38% of businesses (Computer Weekly).

AI doesn’t replace those risks. It sits on top of them. Attackers use it to write more convincing phishing. Staff use it in ways that quietly move data outside your control. Both problems land on the same security team.

The headline numbers:

Breached or attacked
43%of UK businesses in the last year (CSBS 2025/26)
Paste data into AI
18%of enterprise staff (LayerX 2025)
Non-corporate accounts
71.6%of generative AI access (LayerX 2025)
No AI governance
63%of breached organisations had no policy, or were still developing one (IBM 2025)

What “shadow AI” looks like in practice

Shadow AI is the AI version of shadow IT: tools used for work that the business hasn’t approved, can’t see and doesn’t control.

LayerX Security’s Enterprise AI and SaaS Data Security Report 2025 puts some numbers on it. Around 18% of enterprise employees paste data into generative AI tools. More than half of those paste events include corporate information. And 71.6% of generative AI access happens through non-corporate accounts (TechRepublic).

That last figure is the one that matters most. When someone uses a personal account, your data protection controls, retention settings and audit logs don’t apply. The data has left the building, and you have no record of where it went.

The same report found that nearly 40% of files uploaded to these tools contain personal data or payment card data. For any UK organisation subject to UK GDPR, that’s not an abstract risk. It’s a potential reportable incident.

Worth knowing

Blocking AI outright rarely works. Staff switch to personal phones and home laptops, and you lose what little visibility you had.

· Start here

Get a security gap analysis. Free. Two weeks.

We map your controls against a target posture for your size and sector, and hand you a written 90-day plan. No sales follow-up unless you ask for one.

Tell us where you are.
We’ll only use this to reply. Privacy

The cost of getting it wrong

IBM’s Cost of a Data Breach Report 2025 was the first to look closely at AI governance. Its findings are blunt (VentureBeat):

  • 13% of organisations reported a security incident involving their AI models or applications.
  • Of those, 97% lacked proper AI access controls.
  • 63% of breached organisations either had no AI governance policy or were still writing one.
  • Breaches involving employees’ unauthorised use of AI cost an average of $4.63 million, against a global average of $4.44 million.

The pattern is clear. The organisations getting hurt aren’t the ones using AI. They’re the ones using it without rules, without access controls and without visibility.

Five steps to safer AI use

Good AI governance doesn’t need a large programme. Most mid-sized organisations can make real progress in a few weeks with tools they may already own.

  1. Find out what's in use Use your firewall, secure web gateway or CASB logs to see which AI services your people actually reach. The list is usually longer than expected.
  2. Pick approved tools Choose one or two business-grade AI tools with proper data protection terms, and make them easy to access. People use shadow tools when the approved route is harder.
  3. Write a short, plain policy Say what data can and can't go into AI tools, which tools are approved and who to ask. One page that people read beats twenty pages that nobody does.
  4. Put technical controls in place Use your SSE or web filtering to allow approved tools, coach users on unapproved ones and apply data loss prevention to stop sensitive data being pasted or uploaded.
  5. Train and review Show staff real examples of what's safe and what isn't. Review usage logs every quarter and adjust the policy as tools change.

Tiered access works better than all-or-nothing

Not every team needs the same level of access. A tiered model is easier to defend and easier to live with:

  • Open: approved enterprise AI tools for general drafting and research, with DLP in place
  • Controlled: coaching pages or warnings for unapproved tools, so users understand the risk before continuing
  • Restricted: blocked uploads of sensitive file types, and no access from unmanaged devices
  • Privileged: extra controls and logging for teams handling regulated or high-value data

This keeps the business moving while closing the gaps that cause real damage. It also gives you an audit trail when a client, insurer or regulator asks how you manage AI risk, and those questions are becoming more common.

Where to start

If you do nothing else this month, find out what AI tools your people are using today. Visibility comes first. Every other control depends on it.

Then decide which tools you’re happy to support, tell your staff, and make the safe route the easy one. AI can make your teams faster and more effective. It just needs the same discipline you’d apply to any other system that handles your data.

Not sure what AI your team is using?

We’ll help you map current AI use, spot data risks and build a practical access policy.

Book a chat around ai governance

· Share

inX@