Shadow AI finally has a price tag. IBM’s 2025 Cost of a Data Breach Report found that breaches involving high levels of unsanctioned AI use cost an average of $670,000 more than breaches without it — roughly $4.63 million against a $3.96 million global average. One in five breaches studied involved shadow AI. If you have been trying to get budget for GenAI controls by waving vaguely at “data leakage,” you now have a number a CFO will sit still for.
This brief covers what the IBM data actually says, why the ban-and-block reflex fails in practice, the three-layer control pattern that holds up — sanctioned alternatives, inline data protection, and training — and an acceptable-use policy skeleton you can adapt this week.
What changed
Until this report cycle, shadow AI risk was a governance talking point without a dollar figure. IBM’s data changed that. Beyond the $670K premium, the supporting numbers are the real indictment: 97% of organizations that suffered an AI-related breach lacked proper AI access controls, and 63% either had no AI governance policy or were still drafting one when the incident hit. Shadow AI showed up in 20% of breaches — more often than incidents involving sanctioned AI systems, at 13%.
Read that again: the unsanctioned tools your employees are quietly using are now a more common breach factor than the AI you actually deployed. The takeaway for the staff meeting — shadow AI is no longer a policy hygiene item, it is a quantified breach multiplier.
Why it matters
| Shadow AI breaches | Global average | |
|---|---|---|
| Average breach cost | ~$4.63M | ~$3.96M |
| Share of studied breaches | 20% | 13% (sanctioned AI) |
| Customer PII exposed | 65% | 53% |
| Data spanning multiple environments | 62% | — |
The pattern behind the premium is mundane. An employee pastes customer records, source code, or deal terms into a consumer chatbot on a personal account. There is no audit trail, no retention control, and no way to know what left the building — so when a breach occurs, scoping takes longer and disclosure obligations balloon. That is why shadow AI incidents skew so heavily toward PII exposure and multi-environment sprawl. For how these figures stack against overall breach economics, see our data breach cost benchmarks.
Quick diagnostic: if you cannot name the five GenAI tools your workforce used most last week, assume you are in the 63% without a working policy — and budget accordingly.
Why ban-and-block fails
The reflex response is a firewall rule and a memo. It does not work, and the failure mode is predictable. GenAI delivers too much personal productivity for a prohibition to hold: employees route around blocks with personal phones, home machines, and personal accounts — exactly the channels you cannot see. A block without a sanctioned alternative does not reduce usage; it relocates usage to where your DLP is blind. You trade visible, governable risk for invisible risk, which is precisely the condition IBM’s data prices at a $670K premium.
Rule of thumb: never block a GenAI category until the sanctioned replacement is live and demonstrably good enough that reaching for the shadow tool feels like extra work. Prohibition is a sequencing decision, not a strategy.
The control stack that works
Layer 1: sanctioned alternatives with real data boundaries
The cheapest way to shrink shadow AI is to give people a tool they are allowed to use. For Microsoft shops, Microsoft 365 Copilot and Copilot Chat with enterprise data protection put prompts and responses under the same Data Protection Addendum terms as the rest of M365, with no training of foundation models on your data. The strength is ubiquity — it lives where the work already is. The honest caveat: Copilot inherits your M365 permission sprawl, so years of oversharing in SharePoint becomes instantly searchable, and per-seat licensing is a real line item at scale.
Google’s equivalent is Gemini for Workspace, with enterprise-grade data protection, no model training on customer prompts, and compliance support that as of mid-2026 extends to frameworks like HIPAA and FedRAMP High. It is the natural pick for Workspace estates and is often simpler to reason about than Microsoft’s tiering. The gap: outside Workspace-first organizations, Gemini’s enterprise footprint and third-party integration depth still trail Microsoft’s. We compare the two head-to-head in our Copilot vs Gemini enterprise analysis.
Layer 2: inline GenAI data protection at the SSE layer
Sanctioned tools cover the approved path; the SSE layer covers everything else. Zscaler’s approach — AI app visibility and inline data protection running through its Zero Trust Exchange — is representative of the pattern: discover which AI apps are actually in use, then apply prompt-level DLP with block, isolate, or coach actions rather than a blunt deny. The coaching option matters; a just-in-time warning changes behavior in a way a connection reset never will. Zscaler’s strength is that it sees traffic regardless of which app is fashionable this quarter. Its limits are structural: traffic must traverse the proxy, so unmanaged devices and personal phones escape it, and DLP policies for prompts require genuine tuning effort before the alerts are trustworthy.
Layer 3: the human control
Most shadow AI exposure is a well-meaning employee, not a malicious one — which makes training a control, not a checkbox. KnowBe4 has extended its security awareness platform with AI-specific modules and its AIDA agents, which personalize training based on individual behavior. Relative to the rest of this stack it is inexpensive, and it targets the actual failure mode: someone who does not realize pasting a customer list into a chatbot is exfiltration. Be honest about its ceiling, though — KnowBe4-style training measurably reduces risky clicks but cannot enforce anything. It complements the technical layers; it never substitutes for them.
| What it does | Representative vendor | Weak spot | |
|---|---|---|---|
| Sanctioned alternative | Governed GenAI where work happens | Microsoft 365 Copilot, Gemini for Workspace | License cost; permission sprawl |
| Inline SSE protection | Discover apps, prompt-level DLP, coach/block | Zscaler | Blind to unmanaged devices |
| Awareness training | Changes user behavior at the point of paste | KnowBe4 | No enforcement power |
A shadow AI acceptable-use policy skeleton
Most searchers want the template, so here it is. Keep the finished document to roughly one page — policies nobody reads are how you end up in IBM’s 63%. Adapt these eight clauses:
- Scope. Applies to all staff and contractors, on any device, using any AI tool with company data.
- Approved tools. A named, versioned list (e.g., Copilot, Gemini for Workspace) — everything else requires the exception process.
- Prohibited inputs. Customer PII, credentials, source code, unreleased financials, and anything under NDA never enter unapproved tools.
- Account rules. Corporate SSO only; personal accounts on AI services are out of scope for company data, full stop.
- Output handling. AI output gets human review before it ships to a customer, a regulator, or production.
- New-tool path. A lightweight request process with a committed SLA — two weeks or less, or people will not use it.
- Monitoring disclosure. State plainly that AI traffic on corporate networks and devices is logged and inspected.
- Enforcement and exceptions. Graduated consequences, plus a real exception route so edge cases surface instead of hiding.
Wire the policy into a broader governance structure — ownership, risk review, model inventory — using our enterprise AI governance frameworks guide.
What to do about it
Sequence it as 30/60/90. First 30 days: discover — pull AI app usage from your SSE or firewall logs, scan expense reports for AI subscriptions, and run an amnesty survey so people admit what they use without fear. Days 30–60: decide the sanctioned set, publish the one-page policy, and turn on enterprise data protections in whichever suite you already own. Days 60–90: enable inline GenAI DLP in coach mode before block mode, launch AI-specific awareness training, and report shadow-usage trend lines to the risk committee monthly.
The sentence to repeat upstairs: shadow AI adds about $670K to a breach we would already struggle to afford, and the fix is mostly tools we already license plus one policy page. That argument wins budget meetings.
Frequently asked questions
What is shadow AI risk?
Shadow AI risk is the exposure created when employees use AI tools that IT has not approved or configured — typically consumer chatbots on personal accounts. Because the usage is invisible, sensitive data can leave the organization with no audit trail, and IBM’s 2025 data shows such breaches cost about $670K more than average.
Should companies block ChatGPT and other AI tools at work?
Blanket blocking usually backfires — employees shift to personal devices where no control applies. The stronger pattern is a sanctioned alternative with enterprise data protection, inline DLP that coaches rather than just denies, and a clear acceptable-use policy.
What should a shadow AI policy include?
At minimum: scope, a named approved-tools list, prohibited data classes, corporate-account requirements, output review rules, a fast path for requesting new tools, monitoring disclosure, and enforcement with an exception process. One page is the right length.
How do you detect shadow AI use in the enterprise?
Start with SSE or secure web gateway logs (Zscaler and its peers categorize AI apps out of the box), review expense reports for AI subscriptions, and run an amnesty survey. Discovery before enforcement — you cannot govern what you have not counted.
Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.