Shadow AI: A Fatal Flaw for Most Organizations

Learn more about ManageEngine

"Shadow AI represents both the greatest governance risk and the biggest strategic opportunity in the enterprise," said Ramprakash Ramamoorthy, Director of AI Research at ManageEngine. "Organizations that will thrive are those that address the security threats and reframe shadow AI as a strategic indicator of genuine business needs. IT leaders must shift from playing defense to proactively building transparent, collaborative, and secure AI ecosystems that employees feel empowered to use."

The Shadow AI Surge in Enterprises: Insights from the US and Canadian Workplace, a report from ManageEngine based on a survey of IT decision makers (ITDMs) and business employees, investigates the rise of shadow AI — unauthorized AI tools used for work — and identifies critical gaps that organizations need to close if they want to reduce the risks of shadow AI and turn it into a strategic advantage.

The rise: 60% of employees are using unapproved AI tools more than they were a year ago, and 93% of employees admit to inputting information into AI tools without approval.

The risks: 63% of ITDMs see data leakage or exposure as the primary risk of shadow AI. Conversely, 91% of employees think shadow AI poses no risk, not much risk, or some risk that's outweighed by reward.

The rewards: Summarizing notes or calls (55%), brainstorming (55%), and analyzing data or reports (47%) are the top tasks employees complete with shadow AI. Generative AI text tools (73%), AI writing tools (60%), and code assistants (59%) are the top AI tools ITDMs have approved for employee use.

Identifying the Shadow AI Gaps

To turn the use of shadow AI from a liability into a strategic advantage, IT leaders need to close the gaps in education, visibility, and governance revealed by the report. Specifically, a lack of education around AI model training, safe user behavior, and organizational impact is driving systematic misuse. Blind spots continue to grow in organizations, even as IT teams move to approve and integrate AI tools as quickly as possible. Meanwhile, shadow AI proliferates due to inadequate enforcement of established governance policies.

  • 85% of ITDMs report that employees are adopting AI tools faster than their IT teams can assess them.
  • 32% of employees entered confidential client data into AI tools without confirming company approval, while 37% entered private, internal company data.
  • 53% of ITDMs say employees' use of personal devices for work-related AI tasks is creating a blind spot in their organization's security posture.
  • Only 54% of ITDMs report their organizations have implemented clear, enforced AI governance policies and actively monitor for unauthorized use, while 91% have implemented policies overall.

Pivoting to Proactive AI Management

Proactively managing AI means harnessing employee initiative while maintaining security. It delivers the business value discovered in shadow AI but does so via AI tools that are approved by IT. To that end, ITDMs and employees make several strategic recommendations in the report.

  • 63% of ITDMs advise integrating approved AI tools into standard workflows and business applications, 60% suggest implementing clear policies on acceptable AI use, and 55% suggest establishing a list of vetted and approved tools.
  • 66% of employees recommend setting clear policies that are fair and practical, 63% recommend providing official tools that are relevant to their tasks, and 60% advise providing better education on understanding the risks.

"Shadow AI is a fatal flaw for most organizations," said Sathish Sagayaraj Joseph, regional technical head at ManageEngine. "IT teams can't manage risk they can't see — and they can't enable business value that users won't divulge. Proactive AI management unites IT and business professionals in their pursuit of common, organizational goals. That means employees are equipped to understand and avoid AI-related risks, and IT is empowered to help them use AI in ways that drive real business outcomes."

Survey Methodology: In May 2025, ManageEngine commissioned independent market research agency Censuswide to conduct a study of 350 ITDMs and 350 working professionals across the US and Canada, employed in organizations with at least 500 employees and $10M in annual revenue. The survey explored AI usage patterns, security concerns, and governance gaps, with a focus on real-world behaviors across organizations of varying sizes and industries.

Related Links

Hot Topics

The Latest

Implementing AI Isn't the Hard Part Anymore - Adoption Is

Two years ago, almost every customer conversation about AI started with the same questions: Which model should we use? What can it do? Is it ready for the enterprise? Today, those discussions have moved on. CIOs are far more interested in how to govern AI, integrate it with existing systems, prepare their workforce and make it part of everyday operations. The challenge is no longer to prove that AI can deliver value. It's instead about how to embed AI into the business in a way that's secure, scalable and delivers measurable outcomes ...

 

The Incident Load Is Rising, but Recovery Times Aren't Moving

Two things happened to production incidents between 2023 and now, and they did not happen at the same speed. The first is that a class of dependency that barely existed three years ago now accounts for one incident in ten. Incidents disclosed by AI model and AI application providers rose from 1.7% of all disclosed unplanned incidents in 2023 to 10.7% in 2026 year to date, roughly a sixfold rise; that counts only incidents at AI companies themselves, so the true share is higher. The second is that the time to close an incident has not come down ...

Your AI Pipeline May Have a Document Observability Problem

When an AI assistant gives an incomplete or incorrect answer, teams often blame the model. They adjust prompts, switch models, increase context windows or test a new retrieval strategy. However the model may not be a problem. In many enterprise AI workflows, the problem begins inside the document-ingestion pipeline ...

The SIEM Isn't the Problem. Your Telemetry Architecture Is

If you talk to any security or observability teams right now, they're all fighting the same fire: their tooling was built to ingest X, but their sources are pumping Y and soon to be doing Z. The knee-jerk reaction is always the same: we need more platform. However, this reaction is wrong. Let me explain why, because the solution to this problem is foundational, not financial. Instead of hurling yet more money at the problem, make sure you've done what's needed upstream ...

As AI Scales Across Enterprises, Breaking Points Emerge

Rapid AI adoption and the unique ways AI workloads operate is redefining the scope and structure of what these teams must deliver. This shift is forcing organizations to rethink how they manage scale, automation, and control, according to The State of SRE and Platform Engineering 2026, a new report from Dynatrace ...

Preparing Network Infrastructure for AI Starts with the Basics

AI is usually talked about as a software tool, but it also depends heavily on the network behind it. Whether a company is using AI for chatbots, automation, monitoring, analytics, or employee support, all of that information has to move across the network in a reliable and secure way. That means AI is not just an application decision. It is also an infrastructure decision. Before organizations rush into AI, they should ask a simple question: Is our network ready to support it? ...

Agentic Operations Begin with Governed Middleware Access

Enterprise AI often lacks governed access to where business processes actually execute. Without that access, AI agents may be able to reason, but they cannot operate reliably across enterprise workflows. For AI agents to effectively carry out workflows, they will require integration-layer context and controls. Organizations can implement these prerequisites by providing AI with managed access to the middleware layer ...

The Network Data Problem Slowing Down Enterprise AIOps

Enterprise networks rarely behave the same way for very long. A routing adjustment in one region may unexpectedly alter application performance in another. A cloud migration may introduce hidden dependencies that go unnoticed until an outage occurs. All the while, the network is managed by several different teams, each of whom use different tool sets — and as a result, have different views of the network ... There’s usually an engineer who remembers why traffic fails over a certain way between sites, or which transparent firewall was added where. The problem is that human memory cannot scale alongside enterprise-scale networks ...

The Governance Gap Behind AI's Infrastructure Problem

Ask an infrastructure team how confident they are in their ability to govern AI, and most will tell you they've got it handled. A recent survey of 406 IT decision-makers and platform engineering leaders found 86% expressing exactly that confidence. Ask the same group whether they have a formal written AI governance policy, and the number drops to 30%, according to Spacelift's Infrastructure Automation Report ...

MEAN TIME TO INSIGHT Podcast - Episode 27: Observability Unification

In MEAN TIME TO INSIGHT Episode 27, Shamus McGillicuddy, EMA VP of Research, Network Infrastructure and Operations, and Parker Hathcock, EMA Research Director covering IT Service/Operations (ServiceOps), discuss observability unification in modern IT operations ... 

Shadow AI: A Fatal Flaw for Most Organizations

Learn more about ManageEngine

"Shadow AI represents both the greatest governance risk and the biggest strategic opportunity in the enterprise," said Ramprakash Ramamoorthy, Director of AI Research at ManageEngine. "Organizations that will thrive are those that address the security threats and reframe shadow AI as a strategic indicator of genuine business needs. IT leaders must shift from playing defense to proactively building transparent, collaborative, and secure AI ecosystems that employees feel empowered to use."

The Shadow AI Surge in Enterprises: Insights from the US and Canadian Workplace, a report from ManageEngine based on a survey of IT decision makers (ITDMs) and business employees, investigates the rise of shadow AI — unauthorized AI tools used for work — and identifies critical gaps that organizations need to close if they want to reduce the risks of shadow AI and turn it into a strategic advantage.

The rise: 60% of employees are using unapproved AI tools more than they were a year ago, and 93% of employees admit to inputting information into AI tools without approval.

The risks: 63% of ITDMs see data leakage or exposure as the primary risk of shadow AI. Conversely, 91% of employees think shadow AI poses no risk, not much risk, or some risk that's outweighed by reward.

The rewards: Summarizing notes or calls (55%), brainstorming (55%), and analyzing data or reports (47%) are the top tasks employees complete with shadow AI. Generative AI text tools (73%), AI writing tools (60%), and code assistants (59%) are the top AI tools ITDMs have approved for employee use.

Identifying the Shadow AI Gaps

To turn the use of shadow AI from a liability into a strategic advantage, IT leaders need to close the gaps in education, visibility, and governance revealed by the report. Specifically, a lack of education around AI model training, safe user behavior, and organizational impact is driving systematic misuse. Blind spots continue to grow in organizations, even as IT teams move to approve and integrate AI tools as quickly as possible. Meanwhile, shadow AI proliferates due to inadequate enforcement of established governance policies.

  • 85% of ITDMs report that employees are adopting AI tools faster than their IT teams can assess them.
  • 32% of employees entered confidential client data into AI tools without confirming company approval, while 37% entered private, internal company data.
  • 53% of ITDMs say employees' use of personal devices for work-related AI tasks is creating a blind spot in their organization's security posture.
  • Only 54% of ITDMs report their organizations have implemented clear, enforced AI governance policies and actively monitor for unauthorized use, while 91% have implemented policies overall.

Pivoting to Proactive AI Management

Proactively managing AI means harnessing employee initiative while maintaining security. It delivers the business value discovered in shadow AI but does so via AI tools that are approved by IT. To that end, ITDMs and employees make several strategic recommendations in the report.

  • 63% of ITDMs advise integrating approved AI tools into standard workflows and business applications, 60% suggest implementing clear policies on acceptable AI use, and 55% suggest establishing a list of vetted and approved tools.
  • 66% of employees recommend setting clear policies that are fair and practical, 63% recommend providing official tools that are relevant to their tasks, and 60% advise providing better education on understanding the risks.

"Shadow AI is a fatal flaw for most organizations," said Sathish Sagayaraj Joseph, regional technical head at ManageEngine. "IT teams can't manage risk they can't see — and they can't enable business value that users won't divulge. Proactive AI management unites IT and business professionals in their pursuit of common, organizational goals. That means employees are equipped to understand and avoid AI-related risks, and IT is empowered to help them use AI in ways that drive real business outcomes."

Survey Methodology: In May 2025, ManageEngine commissioned independent market research agency Censuswide to conduct a study of 350 ITDMs and 350 working professionals across the US and Canada, employed in organizations with at least 500 employees and $10M in annual revenue. The survey explored AI usage patterns, security concerns, and governance gaps, with a focus on real-world behaviors across organizations of varying sizes and industries.

Related Links

Hot Topics

The Latest

Implementing AI Isn't the Hard Part Anymore - Adoption Is

Two years ago, almost every customer conversation about AI started with the same questions: Which model should we use? What can it do? Is it ready for the enterprise? Today, those discussions have moved on. CIOs are far more interested in how to govern AI, integrate it with existing systems, prepare their workforce and make it part of everyday operations. The challenge is no longer to prove that AI can deliver value. It's instead about how to embed AI into the business in a way that's secure, scalable and delivers measurable outcomes ...

 

The Incident Load Is Rising, but Recovery Times Aren't Moving

Two things happened to production incidents between 2023 and now, and they did not happen at the same speed. The first is that a class of dependency that barely existed three years ago now accounts for one incident in ten. Incidents disclosed by AI model and AI application providers rose from 1.7% of all disclosed unplanned incidents in 2023 to 10.7% in 2026 year to date, roughly a sixfold rise; that counts only incidents at AI companies themselves, so the true share is higher. The second is that the time to close an incident has not come down ...

Your AI Pipeline May Have a Document Observability Problem

When an AI assistant gives an incomplete or incorrect answer, teams often blame the model. They adjust prompts, switch models, increase context windows or test a new retrieval strategy. However the model may not be a problem. In many enterprise AI workflows, the problem begins inside the document-ingestion pipeline ...

The SIEM Isn't the Problem. Your Telemetry Architecture Is

If you talk to any security or observability teams right now, they're all fighting the same fire: their tooling was built to ingest X, but their sources are pumping Y and soon to be doing Z. The knee-jerk reaction is always the same: we need more platform. However, this reaction is wrong. Let me explain why, because the solution to this problem is foundational, not financial. Instead of hurling yet more money at the problem, make sure you've done what's needed upstream ...

As AI Scales Across Enterprises, Breaking Points Emerge

Rapid AI adoption and the unique ways AI workloads operate is redefining the scope and structure of what these teams must deliver. This shift is forcing organizations to rethink how they manage scale, automation, and control, according to The State of SRE and Platform Engineering 2026, a new report from Dynatrace ...

Preparing Network Infrastructure for AI Starts with the Basics

AI is usually talked about as a software tool, but it also depends heavily on the network behind it. Whether a company is using AI for chatbots, automation, monitoring, analytics, or employee support, all of that information has to move across the network in a reliable and secure way. That means AI is not just an application decision. It is also an infrastructure decision. Before organizations rush into AI, they should ask a simple question: Is our network ready to support it? ...

Agentic Operations Begin with Governed Middleware Access

Enterprise AI often lacks governed access to where business processes actually execute. Without that access, AI agents may be able to reason, but they cannot operate reliably across enterprise workflows. For AI agents to effectively carry out workflows, they will require integration-layer context and controls. Organizations can implement these prerequisites by providing AI with managed access to the middleware layer ...

The Network Data Problem Slowing Down Enterprise AIOps

Enterprise networks rarely behave the same way for very long. A routing adjustment in one region may unexpectedly alter application performance in another. A cloud migration may introduce hidden dependencies that go unnoticed until an outage occurs. All the while, the network is managed by several different teams, each of whom use different tool sets — and as a result, have different views of the network ... There’s usually an engineer who remembers why traffic fails over a certain way between sites, or which transparent firewall was added where. The problem is that human memory cannot scale alongside enterprise-scale networks ...

The Governance Gap Behind AI's Infrastructure Problem

Ask an infrastructure team how confident they are in their ability to govern AI, and most will tell you they've got it handled. A recent survey of 406 IT decision-makers and platform engineering leaders found 86% expressing exactly that confidence. Ask the same group whether they have a formal written AI governance policy, and the number drops to 30%, according to Spacelift's Infrastructure Automation Report ...

MEAN TIME TO INSIGHT Podcast - Episode 27: Observability Unification

In MEAN TIME TO INSIGHT Episode 27, Shamus McGillicuddy, EMA VP of Research, Network Infrastructure and Operations, and Parker Hathcock, EMA Research Director covering IT Service/Operations (ServiceOps), discuss observability unification in modern IT operations ...