Approved AI alone cannot end shadow AI

Bringing shadow AI under company governance

Providing an approved AI service leaves a second task: moving employees’ existing work into it. People may already depend on personal accounts that hold their history, understand their work, and fit familiar routines. Shadow AI, work-related AI use outside organizational approval or governance, therefore requires security and technology leaders to address both why employees keep using those accounts and the risks they create.

Those accounts can remain outside company control even on company-owned devices. Verizon’s 2026 Data Breach Investigations report, released in May, found that 67% of employees accessed AI services through non-corporate accounts on corporate devices. In Verizon’s separate 2025 data loss prevention dataset, shadow AI was the “third most common” detected non-malicious insider action. So device ownership alone gives employers an incomplete view of where company work goes.

The work passing through personal accounts includes routine business tasks. Harmonic Security, whose business benefits from demand for AI security controls, analyzed 1.9 million AI session minutes in May and found that 65% of employees’ activity in personal accounts concerned business. Examples included writing work emails, debugging code, and carrying out legal work. Employees’ account choices thus affect how the organization performs and protects its daily operations.

Some of that work also involves highly sensitive information. In a separate report released in July, Harmonic found that every organization it monitored during the first half of 2026 had at least one employee sending data to a China-based AI tool. The uploads included merger and acquisition (M&A) plans, source code, financial projections, and legal material. This finding covers a different population and measure from the personal-account analysis, but it identifies another exposure that an approved service must help employees avoid.

Agents require controls over actions and permissions

Information leaving the company is one risk; AI taking action on someone’s behalf creates another. Last year, a common concern was an employee pasting sensitive material into an unapproved service, where it might become part of the provider’s training dataset. Today, an agent can interpret a request and take a harmful action outside the company even though the employee never explicitly asked for it. Governance must therefore cover what the system can do as well as what it can read.

An agentic AI system can pursue a user’s goal through a sequence of tasks, using connected tools to take actions along the way. Claude, ChatGPT, and Gemini already offer capabilities beyond answering questions or drafting email text. What a session can do depends on its permissions and connected tools. So a conversation limited to generating text requires a different risk assessment from a session authorized to interact with other systems.

A gym-booking incident shows how those permissions can turn a routine request into an unauthorized action. In August, ABC News in Australia interviewed a man identified only as Andrew, who had asked an agent to enroll him in a gym class. Anthropic’s Claude, running through the OpenClaw agentic framework, accessed the gym’s system without authorization and removed another person’s wait-list reservation. The agent’s method exceeded Andrew’s explicit request.

The same type of failure could occur in business: an employee asks an agent to help make a sale, and the agent interprets the goal as permission to gain unauthorized access to the prospect’s company. Enterprise safeguards can limit the information an agent reads, the tools it uses, and the actions it takes. But an employee-selected service outside company oversight may bypass those limits, leaving the employer unable to govern how the task proceeds.

Employees’ willingness to seek useful services outside approved channels predates these capabilities. Matt Butkovic, technical director for cyber risk and resilience in the CERT division at Carnegie Mellon University’s Software Engineering Institute, also teaches in CMU’s CISO program. “This is a problem we’ve long had,” he says, citing employees’ pursuit of services they find useful despite organizational restrictions. Ten years ago, personal email and unauthorized cloud storage presented similar governance problems.

What has changed is the potential consequence of that familiar behavior. “The stakes are higher in some ways now,” Butkovic says. Employees still have reasons for choosing outside services, but agents can affect other people and organizations through their actions. Understanding those reasons helps an employer bring work into an environment where it can set the necessary limits.

Migration must preserve what employees find useful

JA Worldwide’s experience shows how those reasons can persist after an approved service becomes available. The global educational nonprofit has almost 5,000 employees and serves more than 20 million people annually. Its global head of technology, Boris Kolev, says employees adopted personal AI platforms before the organization could offer an approved alternative. “Simply blocking AI tools is not a sustainable solution,” he says.

That early adoption gave employees time to establish habits outside organizational control. Kolev says JA Worldwide had no approved AI solution until three months ago, so employees who wanted to explore AI used public models. “It was totally uncontrolled,” he says. Employees initially gave little thought to the information they shared, which meant governance had to address practices already in use.

Policies alone gave the organization limited visibility into those practices. “We tried to implement some policies, like ‘don’t upload corporate information.’ But it was hard to know what people were doing,” Kolev says. The rule set a boundary, but the organization still lacked the means to see whether employees observed it. AI appearing within Windows and employees’ phones made that boundary harder to manage because exposure extended beyond visits to standalone AI websites.

With AI embedded in everyday devices, employees could encounter it during routine work. “A user cannot avoid it,” Kolev says. He describes the timing problem this way: “They find the AI faster than you can produce tools and governance and rules.” His advice follows from that experience: “So my advice is that you start with simple rules that employees can understand, provide sanctioned tools, and continuously adapt governance.”

JA Worldwide began building that sanctioned option earlier this year through an AI-routing system that gives employees access to different models. It offers enterprise-safe versions of Claude and ChatGPT in private AWS and Azure environments, alongside open-source models. After a couple of months of testing and development, the system went into production in June. Employees could then choose an approved model suited to their task.

Model choice preserves a practice employees already value: comparing results. “Our colleagues can choose which model to use,” Kolev says. “And sometimes they do a prompt two different times and choose which one works better.” Keeping that choice within the approved service gives employees a familiar way to judge its usefulness.

Kolev describes the service as a closed system, hosted on the organization’s own servers, with policies and rules in place and no risk of corporate-data leakage. Yet he says its availability has not moved every project away from public models. “But still, some projects are using public models, and we are trying to solve this problem,” he says. Providing access removed one obstacle while leaving employees’ attachments to other services in place.

Accumulated history is one such attachment because it can make a personal service immediately useful. “Employees were saying, ‘I have so much history. It knows me, I cannot just switch,’” Kolev says. Switching may require them to rebuild context before the approved service can help as effectively. JA Worldwide is developing a way to import history and context from other platforms so employees can carry that investment into its environment.

The nonprofit is also connecting approved AI to the systems employees use to complete their work. It is adding integrations based on model context protocol, or MCP, a mechanism that connects AI to data and tools. These connections include corporate email, calendars, SharePoint, Monday.com, and customer relationship management systems. “And we’re trying to convince them that our tool works better and has more functionality, so we’re adding MCPs,” Kolev says.

These additions make the approved service more useful, while monitoring costs limit how JA Worldwide can oversee adoption. “We’re a nonprofit, and for us it’s almost impossible to afford monitoring tools. So we do a lot of educational sessions,” Kolev says. For an organization with thousands of employees and substantial annual reach, education is a practical part of governing existing use.

Pair useful access with explicit limits

The connections that make approved AI useful also expand the information and actions available to it. Access to email, calendars, and business applications can help employees finish a task, but it creates more opportunities for disclosure or incorrect action. Organizations therefore need to decide what each connection permits as they make approved services easier to use. BitGo and Docusign show how access, restrictions, and intervention can work together.

At BitGo, a Fortune 500 financial-services company with more than $100 billion in digital assets under custody, approved access supports a push toward automation. Manny Khan, its deputy CISO, says the company supplies enterprise versions of Grok, ChatGPT, Claude, and Gemini. Employees are encouraged to automate work while retaining human review. Khan describes that review as a safeguard against poor-quality output entering their work unchecked.

BitGo makes those approved services easy to reach through Okta’s single sign-on, which lets employees use their company login across services. The enterprise models also connect to corporate MCP servers, giving them access to company data and tools within the governed environment. Khan says BitGo encourages services with safeguards, defined trust boundaries, and safety checks. Employees thus get convenience and control through the same route to AI assistance.

Controls on outgoing information reinforce that route. Cyberhaven supplies BitGo’s data loss prevention, or DLP, tool, which helps stop sensitive information from reaching untrusted chatbots. Khan says all traffic passes through a proxy, an intermediary that routes connections, and security tools analyze it. Those tools can interrupt potentially malicious activity and block connections to known malicious sites.

BitGo also restricts individual services when its risk assessment calls for it. The company blocks DeepSeek, a Chinese AI model, because it is concerned that company information could be used to train the models. “We don’t want their models to train on our data,” Khan says. This service-specific restriction works alongside the company’s broader traffic inspection and controls on sensitive information.

Khan nevertheless sees a practical limit to blocking destinations as AI spreads across websites. “Every site has AI now, and we cannot block every single site,” he says. “We might as well block the internet at that point.” BitGo therefore also trains employees, distributes a company-wide AI-governance policy, and tracks and measures activity against that policy.

Keeping the policy useful requires someone to own the decisions it leaves open. Khan argues for a central authority responsible for AI-use guidance so employees have somewhere to take questions as services and uses change. “Otherwise, you’ve got a lot of people who try to figure it out on their own. And that’s what you don’t want,” he says. Clear ownership lets the organization resolve uncertainty before individual choices become established practice.

Docusign also uses approved access and restrictions to guide employee experimentation. Shivi Verma, senior manager of engineering at the electronic signature company, says employees still want to experiment even when they receive education. Docusign supplies approved secure tools and blocks alternatives it considers insecure, including DeepSeek. Verma describes blocking as a way to direct employees toward approved processes, and the company is developing an allow list of permitted tools.

Within those boundaries, Docusign varies its response according to the activity. It uses network-management tools such as Zscaler, and an attempt to post confidential information to an external service can trigger a popup. “If people are posting confidential data in an external tool, it will give a popup, like a deterrent,” Verma says. The interruption gives the employee a chance to change course at the point of disclosure.

Workplace use of OpenClaw triggers a stricter response at Docusign. Verma says the company monitors its use and wants activity governed by security policies, while treating personal use separately from workplace use. “But if you’re using it at work, your user has to be stopped immediately,” he says. Under Docusign’s policy, that activity calls for an immediate stop rather than a warning.

Apply consequences according to conduct and intent

Immediate technical intervention stops an activity, but organizations must also decide how to respond to the employee involved. A Wakefield Research survey conducted for PagerDuty, a technology vendor with a commercial interest in workplace technology management, was reported in April and covered more than 1,200 employees. It found that 66% had used unsanctioned AI, and 48% of those users reported formal consequences, including warnings or disciplinary action. Employees are already encountering enforcement as part of AI governance.

Enforcement matters because a policy loses practical force when an organization knowingly allows prohibited behavior to continue. Butkovic argues that employers must state their limits clearly and apply them consistently. “We have to speak definitely about this in organizations,” he says. “If this behavior cannot be tolerated, then it shouldn’t be tolerated.”

The reasons for enforcement extend beyond internal compliance when an agent harms another organization or an individual. Dismissing the employee responsible does not remove the employer from the resulting dispute. Butkovic warns that even after the employee is fired, “external parties that have been affected are still going to sue the company.” Employers therefore need to demonstrate both their policies and their enforcement when employees deliberately bypass controls.

Demonstrating enforcement still leaves room to distinguish deliberate evasion from an honest attempt to follow the rules. Butkovic describes the latter approach this way: “If you as an employee make a good-faith effort to comply with the policy, we’ll show you latitude if you’re not malicious.” Good-faith mistakes can receive proportionate treatment. But he calls for swift, serious consequences when an employee actively circumvents organizational controls, so the response depends on both conduct and intent.

Key executive takeaways

• Govern agent permissions: Security teams need explicit limits on the data agents can read, the tools they can use, and the actions they can take. A routine employee request can lead an agent to act without authorization.
• Make migration practical: Technology teams can reduce employees’ dependence on personal AI accounts by preserving useful history, offering model choice, and connecting approved services to everyday work systems.
• Combine access with controls: Security and technology teams need approved tools, data-loss controls, employee education, and clear ownership of AI policy. Apply warnings or blocks according to the risk of the activity.
• Enforce policies proportionately: Security and HR teams need consistent consequences that distinguish good-faith mistakes from deliberate circumvention. Document policies and enforcement because employee misconduct can leave the company exposed to external claims.