Shadow AI Statistics 2026: Adoption, Cost, and Real Risk

43% of breached organisations hit a shadow AI incident in 2026, up from 20% a year earlier (IBM). Those breaches averaged $5.39M against a $4.99M global average. Meanwhile, among the organisations breached through AI, the share holding any AI governance policy fell from 37% to 32%.

Here is the catch, and it shapes everything below. Almost every shadow AI statistic in circulation comes from a company selling shadow AI detection, and a lot of them cannot be traced back to anyone at all. We know, because we audited our own database first and found three figures citing content farms instead of the researchers who produced them. Every number on this page names and links the organisation that published it. Where a figure carries a limit that changes what it means — a narrow sample, an overlapping cohort, a measurement of conversations rather than people — we say so at the point you read it. And where we tested something ourselves, we show you what broke.

📊 Key Shadow AI Statistics at a Glance

Shadow AI means staff using AI tools the business has not approved — a personal ChatGPT account for a work report, an AI notetaker in a client call, a browser extension nobody vetted. These are the headline figures, each traced to the organisation that produced it.

Send me the book →

By submitting you'll get the book + occasional related emails. Unsubscribe anytime. Privacy.

🔍 We Audited Our Own Statistics First. Three of Nine Cited the Wrong Source.

Before writing this page we audited every shadow AI figure already in our database. Nine entries. Three cited SEO content farms rather than the organisations that did the research, and two more duplicated the same IBM figure under different names.

Most of the underlying numbers were defensible. The citations were not. That is the ordinary failure mode in this subject: a figure gets published once, then repeated for years while the trail back to its source rots away. We re-sourced every one before publishing this article.

One correction is worth stating plainly, because we got it wrong in the other direction too. During earlier research we blacklisted the "43%" figure as an unverifiable inflation of IBM's 2025 number. It is IBM's genuine 2026 statistic, published on 29 July 2026. We were right about the evidence available at the time and wrong about the number. Both errors — trusting a bad citation and rejecting a good figure — come from the same place: nobody checks.

📈 How Common Shadow AI Actually Is

43% of breached organisations reported a shadow AI incident in IBM's 2026 Cost of a Data Breach Report. A year earlier it was 20%.

Read that figure carefully. It is 43% of organisations that suffered a breach — not 43% of all breaches, and not 43% of all companies. IBM surveyed 602 organisations across 17 industries and 16 countries via the Ponemon Institute, with fieldwork running March 2025 to February 2026. Breached organisations are not a random sample of all organisations, so this tells you about companies that had a bad year, not about the market as a whole.

💰 What a Shadow AI Breach Costs

$5.39M is the average cost of a breach involving shadow AI (IBM 2026). The global average for all breaches is $4.99M, itself a record high and up 12% year over year.

Two caveats. First, those three cohorts overlap — a breach can be both AI-enabled and involve shadow AI, so they are not exclusive categories you can stack. Second, this is an observational comparison inside one study. Organisations with shadow AI incidents likely differ from those without in ways IBM does not control for. The data shows an association. It does not prove shadow AI caused the extra $400,000.

👥 What Employees Are Actually Doing

66% of office professionals have used AI at work believing it was not permitted under company policy. 88% have shared work information with public AI tools like ChatGPT, Claude or Gemini (PagerDuty, 2026).

The methodology matters here. Wakefield Research surveyed 1,250 office professionals at organisations with $500M+ annual revenue, deliberately excluding IT and technology roles, across the US, UK, Australia and Japan. So this measures ordinary office staff, not engineers.

One nuance worth preserving: the 66% figure describes what staff believed was not permitted. It is a measure of knowing-and-doing-anyway, which is a different and more useful thing than measuring policy breaches directly.

89% of those using AI for work first met the tool in their personal life. That is the mechanism: people bring a habit from home, find it works, and keep going. 72% believe they understand AI better than their own tech team, and 81% think leadership plays by different rules. Whatever you think of those beliefs, they explain why a policy memo does not change behaviour.

🕵️ The Visibility Gap

47.11% of enterprise AI conversations happen through personal identities rather than corporate-managed accounts (LayerX telemetry, 2026). That traffic sits outside your identity controls by design: no corporate login, so no account-level policy, no retention control and nothing to revoke when someone leaves. Your network, endpoint or browser tooling may still see it — LayerX measured this precisely because its own browser telemetry does — but the provider-side account is not yours.

There is a second layer underneath that. Of the conversations that do use a corporate identity, 14.39% run on a personal AI licence. The login looks corporate, so it passes a casual audit, but the organisation still has no control over how that data is stored, retained or used for training.

Gartner reaches a similar place from a different direction: 57% of workers use personal GenAI accounts for work. And the problem is not confined to AI — Verizon found that 46% of compromised systems holding corporate logins were unmanaged devices carrying personal credentials alongside them, while 78% of insider incidents already involve cloud or SaaS platforms. Unsanctioned AI is the newest layer on an access-control problem that predates it.

📤 How Much Data Is Actually Leaving

18,033 terabytes of enterprise data went to AI and machine learning applications in 2025 — a 93% increase year over year. Zscaler measured this across roughly 989 billion AI/ML transactions on its Zero Trust Exchange between January and December 2025.

410 million data-loss-prevention violations were tied to ChatGPT alone, including attempts to share Social Security numbers, source code and medical records. The number of applications driving AI traffic quadrupled to more than 3,400 — which is the practical problem with any blocklist approach, as we will show with measurements further down.

✍️ The Biggest AI Data Destination Is Not ChatGPT

Grammarly received 3,615 TB of enterprise data in 2025. ChatGPT received 2,021 TB. The writing assistant took in roughly 1.8 times as much company data as the chatbot every AI policy names first.

This is not an argument about Grammarly specifically. It is an argument about where your data actually goes versus where you assume it goes. A writing assistant sees every document it helps with. If your controls are built around the tools that make headlines, the largest flow is the one you are not watching.

The 16-minute figure is worth sitting with. Zscaler found critical flaws in 100% of the enterprise AI systems it analysed, and judged that most could be compromised in about a quarter of an hour. That is the sanctioned side of the estate — the AI you deployed on purpose — which makes the 3,400-application sprawl on the unsanctioned side harder to wave away.

📉 Governance Is Going Backwards

Of the organisations that suffered an AI-related incident, 68% had no AI governance policy — leaving just 32% that did. The year before, 63% lacked one. The gap widened while shadow AI incidents more than doubled.

An important limit on this claim. Both figures describe breached organisations only. A fall from 37% to 32% within that group does not prove governance is declining across all businesses — the composition of who got breached can shift year to year. What it does show is that among companies that suffered a breach, governance was rarer this year than last.

⚖️ Shadow AI vs Your Own AI

Among breached organisations, shadow AI incidents were reported roughly twice as often as breaches of the organisation's own sanctioned AI models and applications — 43% against 21%.

These categories are not mutually exclusive — an organisation can appear in both, and IBM is counting organisations rather than incidents. Even so: most AI security work goes into hardening the AI you deployed on purpose, while the unsanctioned side turns up in twice as many organisations. IBM does not measure where the budget went, so treat that as a prompt to check your own split rather than a finding about the market.

📋 Policy Exists. Compliance Does Not.

86% of PagerDuty's respondents work somewhere they believe has an AI policy. 66% used AI they believed that policy prohibited. Having the document is not the same as changing what people do.

Both figures come from the same PagerDuty survey, but treat the comparison carefully. PagerDuty published no respondent-level cross-tabulation, so these are not demonstrably the same individuals, and the press release does not state the base for each question. Read them as two measurements of one surveyed population, not as a proven overlap — and if you need to cite the gap precisely, go to the full report for the bases rather than relying on this page.

🎯 What Security Teams Are Actually Worried About

Data leakage from GenAI is now the top AI-related concern in the World Economic Forum's 2026 outlook at 34%, ahead of adversarial AI capabilities on 29%. That is a reversal — the fear used to be attackers with better tools, not staff with a chatbot.

The concern is broadly correct, but note how it sits against the spending. 60% of organisations report high concern about AI misuse by insiders, yet only 19% coordinate AI governance with their security team. Concern is cheap. Ponemon puts a number on the alternative: organisations running a formal insider risk programme avoided $8.2M in annual breach costs.

🏢 Embedded AI: The Part You Cannot Block

The applications driving AI traffic quadrupled to more than 3,400 in a year. A large share of that growth is AI features built into software you already bought and approved.

Zscaler's finding is blunt: embedded AI features "are often active by default and escape detection by legacy security filters". Atlassian was among the leading sources of embedded AI activity, reflecting AI inside Jira and Confluence. You cannot block those domains — they are the tools your business runs on.

🔐 Access Controls: 92% Did Not Have Them

Of organisations that suffered an AI-related breach, 92% lacked proper AI access controls (IBM 2026). Across IBM's surveyed organisations, only 40% use access controls on AI models and data at all.

IBM's X-Force analysis independently confirms both figures. The 2025 equivalent was 97%, so there is movement in the right direction — but from a very low base, and only 19% of organisations coordinate AI governance with their security team, which is the rarest control measured anywhere in this data.

🧠 Shadow AI Is an Insider Problem With a New Tool

75% of insider incidents are non-malicious, and 55% come from negligent or mistaken employees rather than bad actors (Ponemon/DTEX 2025). Ponemon does not separate shadow AI out, so we cannot say what share of those incidents involve AI. But the profile fits the behaviour every survey on this page describes: people trying to do their job faster, not people trying to cause harm.

This matters because insider risk has been measured for years, and the trend was already ugly before AI arrived.

78% of insider incidents already involve cloud or SaaS platforms, and 60% of organisations report high concern about AI misuse by insiders. If you have an insider risk programme, shadow AI belongs inside it rather than in a separate initiative. Organisations with a formal programme avoided $8.2M in annual breach costs — that figure and the $19.5M annual cost come from the 2026 edition of the Ponemon/DTEX report, while the 75% and 55% splits come from the 2025 edition, which is the most recent to publish that breakdown.

Send me the book →

By submitting you'll get the book + occasional related emails. Unsubscribe anytime. Privacy.

⚠️ Shadow AI Statistics You Should Not Trust

These figures circulate widely. Three of them have no traceable source at all. The other two are real numbers that get restated as something they are not — which is the more common failure, and the harder one to spot. If you see any of them in a vendor deck, ask where it came from.

🧪 We Tested the Free Tools. Here Is What They Caught.

Every competing page on this topic cites the same vendor reports. None of them ran a test. We did, in August 2026, and the results are the only figures on this page that are not somebody else's research.

Out of the box, Microsoft's Presidio missed API keys, database passwords, AWS keys, UK sort codes and UK postcodes. Writing custom recognisers for UK identifiers and secrets took it from 4 of 12 to 10 of 12 — but false positives on legitimate business text rose from 3 to 8. Better recall is not free, which is why we would run it in warn mode before blocking anything.

The blocklist result is the more damaging one. We measured six AI blocklists — five free, plus a teaser sample of a commercial feed — against a ground truth built from vendor documentation. The best free list caught 15 of 18 domains, or 83%. Two scored 0%: they target AI-generated websites rather than AI tools, which is not obvious from their descriptions.

Stacking all five free lists together caught 19 of 26 domains on our wider list, which includes eight endpoints only the commercial feed documented. Two denominators, deliberately: 18 is the fair test (scoring a commercial list against domains derived from itself would be circular), and 26 is the fuller picture of what is actually out there. Neither number is close to complete coverage.

⏱️ Shadow AI by the Minute

Annual totals are hard to picture. Broken down, the scale is easier to hold.

🇬🇧 The UK Picture

71% of UK employees have used unapproved consumer AI tools at work, and 51% do so every week (Microsoft UK / Censuswide, n=2,003, October 2025).

22% used consumer AI assistants for finance-related tasks. Only 32% expressed concern about the privacy of company or customer data they entered, and 29% about the security of their organisation's systems.

🏛️ One Shadow AI Incident on the Public Record

Almost every figure above this line comes from a company selling security products. This one comes from a legally required disclosure instead.

On 11 May 2026, CB Financial Services, Inc. (NASDAQ: CBFV) filed a Form 8-K under Item 1.05, Material Cybersecurity Incidents. In the filing's own words, its subsidiary Community Bank had become aware of "an internal incident involving the handling of certain non-public customer information using an unauthorized artificial intelligence-based software application."

Read what the filing does and does not say. It calls the event an internal incident and says it did not involve disruption to operations, customer account access, payment systems or core IT — so no outage, and nothing describing an intrusion. It cites the volume and sensitive nature of the information as the reason the company judged the event material, and names what was disclosed: customer names, Social Security numbers and dates of birth, handled through an AI application the bank had not authorised. The filing does not name the application, say who used it, or explain how the data reached it, and the investigation was still ongoing when the 8-K was filed.

We searched EDGAR's full-text index for shadow AI in 8-K filings and found seven. Six are security vendors — Zscaler, CrowdStrike, Tenable, F5, JFrog and AvePoint — using the phrase as marketing language in earnings releases. Searches for “unsanctioned AI” and “unauthorized AI tool” return nothing at all. CB Financial's is the only filing we could find describing an actual incident, though EDGAR full-text search covers 2001 onward and a filing could always describe the same thing in different words.

Law firms covered it in May, correctly, as a disclosure-timing story. The operational lesson is narrower, and it is about where the risk sits rather than which control failed: this happened inside a regulated bank — an organisation with every reason to hold an AI policy, and with more compliance scrutiny than most businesses will ever face. The filing does not tell us which control was missing, and we should not pretend otherwise. What it does tell us is that the 43% figure at the top of this page is not an abstraction. It looks like this when it happens to one named company, and it reaches the SEC.

📐 How Do You Compare?

Four questions, answered in your browser. Nothing is sent anywhere.

❓ Frequently Asked Questions

🧮 About This Data

This article draws on 55 statistics held in our research database and tagged as shadow AI or directly adjacent to it. Every figure names the organisation that published it and links to that organisation's own page, not to a summary of it.

The primary sources are IBM Cost of a Data Breach 2026 (602 organisations, Ponemon Institute, 17 industries, 16 countries, fieldwork March 2025 to February 2026), PagerDuty's Shadow AI Survey (Wakefield Research, 1,250 office professionals across the US, UK, Australia and Japan, excluding IT roles), LayerX State of AI Usage 2026 (browser telemetry), Zscaler ThreatLabz 2026 (approximately 989 billion AI/ML transactions), Microsoft UK / Censuswide (2,003 UK employees, October 2025), Gartner, the World Economic Forum, Cisco and the Ponemon/DTEX Cost of Insider Risks series.

Statistics marked "Nathan House's Analysis" are derived — computed by cross-referencing entries in our database rather than quoted from a report. Each one shows its arithmetic so you can check it. Where a derived figure is our calculation rather than something the original publisher stated, we say so explicitly.

The Presidio and blocklist results are our own testing, run in August 2026. Method and full results are described in the section above.

Last updated: August 2026.

About the Author

Nathan House, Founder & CEO of StationX

Nathan House has 30 years of hands-on cybersecurity experience and is Cambridge-educated, holding CISSP, CISA, CISM, OSCP, CEH, and SABSA. He founded StationX in 1999 — one of the UK’s first cybersecurity companies — and has secured £71 billion in UK mobile banking transactions and the London 2012 Olympics, advising clients including Microsoft, Cisco, BP, Vodafone, and VISA. He authored the world’s most popular cybersecurity course — a #1 Udemy bestseller taken by over 500,000 students — and was named Cyber Security Educator of the Year 2020, AI Security Educator of the Year, and a UK Top 25 Security Influencer 2025. A DEF CON speaker and featured expert on CNN, Fox News, NBC, and the BBC, Nathan leads StationX’s training of more than half a million students worldwide.