Ask a security team which AI tools their organisation uses and you'll usually get a list of the ones that went through procurement. Ask which tools their people use and the honest answer is that nobody knows.
That gap is the whole problem, and it's worth understanding before deciding what to do about it.
Why the gap exists
Shadow AI isn't a governance failure in the usual sense. There's no procurement process to circumvent, because these tools require no procurement. They're free, they run in a browser tab, they need no install and no admin rights, and they're genuinely good at the work people are trying to do.
Every incentive points toward using them. The friction that normally creates a paper trail — a purchase order, a security review, an IT ticket — simply isn't there.
What visibility typically surfaces
We won't quote numbers from customer deployments; we don't have a large enough sample to generalise honestly, and inventing benchmarks is exactly the thing that makes security marketing untrustworthy. But the categories of finding are consistent enough to describe.
More tools than expected. The approved list has one or two entries. Actual usage spans considerably more, including tools nobody in security had heard of. This is where a catalogue-based approach struggles: you can't enumerate what isn't in the catalogue.
Usage concentrated in a minority of staff. A relatively small group generates most prompts. Usually engineering and customer-facing teams — the people with the most repetitive text work. This matters for how you respond: a broad policy change affects everyone, but the exposure is concentrated.
Source code is the most common sensitive category. More common than personal data in most environments we've looked at. Developers paste a function to ask why it's failing. It's reflexive, it's often the fastest way to an answer, and the code is frequently under a client NDA.
Secrets appear, and they're the highest severity. Less frequent than code, but a pasted AWS key or bearer token is unambiguous. There's no legitimate reason for a credential to be in a chatbot prompt, which makes it the easiest thing to hard-block without argument.
Almost none of it is malicious. This is the important one. The pattern is overwhelmingly competent people moving fast — pasting a whole error log rather than the relevant line, including the customer email because trimming it takes an extra step.
How to read the data without overreacting
The instinct on seeing the first week is to block aggressively. That's usually a mistake, for a reason that has nothing to do with being permissive.
Blocking pushes usage where you can't see it. If the work laptop won't let someone paste a stack trace into ChatGPT, they'll use their phone. You haven't prevented the exposure; you've removed your visibility into it and lost the ability to redact.
A sequence that works better:
Run in warn mode first. For a couple of weeks, detect and record without interfering. You learn what your traffic actually contains, and you find your false positives on real data rather than on assumptions.
Hard-block only the unambiguous. Private keys, credentials, government identifiers. Nobody argues these belong in a prompt, so the policy generates no resentment.
Redact the middle ground. Emails, phone numbers, card numbers. The person still gets their answer; the identifier never leaves. This is the highest-value action in the set and the most underused — it's the only one that reduces exposure without reducing usefulness.
Warn on judgement calls. Source code is contextual. Internal utility code is fine; client code under NDA is not, and a detector can't reliably tell them apart. A warning puts the decision with the person who has the context, and teaches the boundary in the process.
The uncomfortable finding
Most organisations discover their biggest exposure isn't a tool they need to ban. It's a habit they need to change — pasting more context than the question requires.
Nobody needs the entire customer record to ask how to phrase a refund email. But trimming it takes ten seconds, and the whole reason people reach for an AI tool is that they're trying to save ten seconds.
That's why we think redaction beats blocking. It removes the exposure without asking anyone to be more careful than they have time to be. Relying on people to be careful under time pressure is not a control; it's a hope.