78% of your employees use a generative AI tool without authorisation. That is a firm figure, not a projection. 76% of your security teams do the same. And 20% of data breaches in 2025 involved an AI tool deployed by an employee rather than by the IT department. Shadow AI is not a hypothetical risk: it is already the number one way into corporate infrastructure. Here is what it really is, why a pure ban does not reduce it, and a methodology that makes it disappear without killing productive use.

1. What Shadow AI really is

Shadow AI refers to the use of artificial intelligence tools by employees, with company data, outside any IT or HR governance. It is not a technical bug, it is a rational human practice: the employee has a concrete problem (writing an email, summarising meeting minutes, coding a script, analysing a file), ChatGPT or Claude solves it in 30 seconds, and the company has offered nothing. So they go and find the solution themselves.

The most widespread forms in 2026:

Every time an employee copies and pastes, connects, authorises or shares company content with an unvalidated AI service, that is Shadow AI.

2. The figures that should worry every executive

Eight key figures on Shadow AI in 2025-2026: 78% of employees, +156% growth, 32% of exfiltrations, 20% of breaches, 29% of IP leaks, $1.8M average fine, $670k remediation surcharge, 76% of security teams outside the rules.
Shadow AI 2025-2026 — the picture in numbers

Sources: Second Talent, UpGuard, Cloud Radix, Vectra AI, eSecurity Planet.

Three figures deserve a slow read. 78% means it is the norm, not the exception. 76% among security teams shows that the problem cannot be solved by discipline: even the professionals who are supposed to follow the rules bypass them daily. And 20% of breaches involving Shadow AI turns the subject from a future risk into a measured reality.

The costliest point is a quieter one: $670,000 of extra remediation cost per Shadow AI incident compared with a conventional breach. Generative AI adds a forensic complexity that is unfamiliar to security departments used to traditional leaks. You no longer know exactly what leaked, for how long, to whom, or how to recover it.

3. Three case studies to know

Samsung, March 2023: three leaks in a month

The story is now a staple of compliance courses. Three Samsung Electronics engineers in the semiconductor division separately used ChatGPT for three different tasks: fixing a bug in an equipment measurement program, optimising code that detects defective chips, and generating confidential meeting minutes (TechCrunch).

Three leaks in a month in Samsung's most strategic division. The source of each leak: an individual habit. The response: a blanket ban. Samsung banned all generative AI internally and developed its own tool in parallel.

Apple, May 2023: the preventive ban

Apple banned ChatGPT, GitHub Copilot and other AI assistants for some of its engineers as early as May 2023, without having experienced a documented leak. The reasoning: the risk of a leak to third-party servers (OpenAI, Microsoft) is structurally incompatible with Apple's product policy (TechCrunch).

This is the ban imposed before the leak. Apple has since been developing its own internal models and a private Claude-like model negotiated with Anthropic.

Vercel, April 2026: the industrial-scale breach through an individual Shadow AI

The Vercel attack chain broken down into 5 steps: a Vercel employee authorises Context.ai with an Allow All OAuth scope in February 2026, a Context.ai employee is infected by the Lumma Stealer, the OAuth tokens are stolen, the attacker accesses the Vercel Google Workspace then extracts customers' env vars and API keys, and the whole lot is put up for sale for 2 million dollars by ShinyHunters.
How an individual Shadow AI becomes a $2 million breach

Sources: Dark Reading, The Hacker News, Trend Micro, Vercel Security Bulletin April 2026.

The Vercel case is a defining one because it shows how an individual Shadow AI becomes an organisational catastrophe. Timeline:

  1. February 2026. A Vercel employee, on their own initiative, signs up to Context.ai (a third-party AI tool) with their Vercel Enterprise Google Workspace account. They accept the OAuth permissions request by clicking "Allow All" without looking at the scope. Vercel's Workspace settings allow this kind of broad authorisation.
  2. February 2026. In parallel, a Context.ai employee downloads what they think is a Roblox cheat code. The file contains the Lumma Stealer, an infostealer that siphons off their credentials: Google Workspace, Supabase, Datadog, Authkit.
  3. March 2026. The attackers hold the OAuth tokens of all Context.ai customers, including that of the Vercel employee.
  4. April 2026. The attackers use the token to log in to Vercel's Google Workspace and reach vercel.com/context-inc/valinor/settings/environment-variables. They exfiltrate the environment variables and API keys of Vercel customers.
  5. 19 April 2026. ShinyHunters puts the data up for sale on BreachForums for 2 million dollars. Vercel publishes a security bulletin the same day (Vercel Knowledge Base).

The key point: no step assumes intentional negligence. A well-meaning employee, a useful tool, an OAuth click that became a habit. The five steps are individually mundane. Together they amount to a supply chain attack on a platform used by more than a million developers worldwide.

4. Why a pure ban does not work

Field observation In companies that banned AI without offering an official alternative, Shadow AI figures are IDENTICAL to those of companies that did nothing. Sometimes worse, because covert use removes even the internal audit signals.

Three structural reasons explain why a naive ban fails systematically.

The need remains real. Your employee who used to write a report in three hours with ChatGPT is not going to go back to three hours of manual work after a ban. They will find another way, a less visible one. AI is a personal productivity gain, not a curiosity.

Evasion is cheap. A personal smartphone next to the work computer is enough to make Shadow AI invisible to classic DLP tools. The employee photographs the screen, retypes the content on their phone, photographs the answer again. Technical solutions have reached their limits.

A ban creates a signal of distrust. A team that is forbidden to use AI feels treated like children. Motivation drops, turnover rises, and the best people leave for competitors who, for their part, have reliable AI tools.

Together, the three mean that a ban produces a deeper Shadow AI, not a Shadow AI that has been removed.

5. The methodology that works

Six-step methodology for eliminating Shadow AI: an honest audit of usage, deployment of official tools aligned with needs, drafting of a two-page AI charter, active detection through AI DLP, quarterly OAuth governance, continuous training.
Moving from the ban that does not work to the governance that holds

Synthesis of approaches proven at companies that reduced their Shadow AI by 70% or more in 2025: Samsung post-ban, Amazon, JPMorgan, BNP Paribas.

Step 1 — Honest audit. Send a strictly anonymous survey to your teams: which AI tools they use, for which tasks, with which data. If you do not guarantee anonymity, the answer will be falsely reassuring. The aim is to learn the real scale, not to identify culprits.

Step 2 — Official tools aligned with needs. Deploy Claude Team, ChatGPT Enterprise or Microsoft Copilot accounts with data isolation (no training on your inputs). The cost per user is 25 to 60 dollars a month. Compared with a $670,000 incident, the decision is obvious.

Step 3 — A concrete AI charter. Two pages, no more. It defines: authorised tools, prohibited zones (named client data, ongoing contracts, sensitive source code, patented IP), and the level of validation required depending on sensitivity. It does not pass moral judgement, it clarifies. See our AI audit methodology to frame the zones.

Step 4 — Active AI DLP detection. Install a solution that detects flows to AI domains (chatgpt.com, claude.ai, perplexity.ai, gemini.google.com, etc.) from work machines. Mature solutions in 2026: Nightfall, LayerX, Palo Alto Networks AI Security, Netskope One GenAI. Cost: between 5 and 15 dollars per user per month. These tools do not block by default; they flag and ask for a human decision.

Step 5 — Quarterly OAuth governance. The Vercel case shows that the quietest way in is OAuth. Every quarter, review the list of third-party applications authorised on the company's Google Workspace or Microsoft 365. Revoke every "Allow All" scope. Limit to the strictly necessary scopes. Explicit policy: no third-party AI app is authorised without a security review.

Step 6 — Quarterly continuous training. Not a generic annual session. 45-minute capsules every three months, with recent real cases: Samsung, Vercel, sector examples specific to your trade. The aim: that every employee understands intuitively why a red line exists before crossing it.

6. The KPI that should drive your governance

Shadow AI is never at 0. Aiming for 0 is an illusion and a trap: you lie to yourself, your teams lie to you, and the measurement becomes false.

The right indicator is the ratio of official usage to total usage, measured quarterly. A good score is above 85%. A score below 50% signals that the official tool is poorly aligned with real needs, or that the charter is too restrictive. A score above 95% is suspect: your detectors are probably missing some usage.

This ratio is measured by cross-checking: a half-yearly anonymous survey + DLP logs + usage logs of the official tools. The three sources make the measurement robust.

7. What an SMB with no IT department can do from Monday

You do not have an in-house security team, you do not yet have an AI charter, and you strongly suspect Shadow AI. Three minimal actions starting next week.

These three actions cost less than 3,000 euros and 4 hours. They reduce your Shadow AI incident risk by 60 to 80%. The rest is refinement.

Conclusion

Shadow AI is not a discipline problem. It is a design problem. Your teams use AI tools because they make their work better. If you do not provide the official version, they will keep going elsewhere. If you forbid everything, they will do it more discreetly.

The question is therefore not "how do we prevent the use of AI". It is "how do we channel it towards tools aligned with your governance". The difference is a defining one: it turns a risk into a measured productivity gain, and it protects your company from the effects of the next Vercel.

2026 is the year Shadow AI incidents become a board-level subject in large companies. In an SMB, it is already the moment to put in place the first charter, even an imperfect one, and to offer the first official tool, even an incomplete one. The cost of inaction is measurable and the cost of action is marginal. Start.