The loudest threat actors in 2026 are not the ones you read about on a Friday night. They are the ones already inside your building, sitting at a desk, doing their job. SailPoint’s Steve Bradford put it bluntly in a recent piece for TechRadar Pro: 93% of CEOs (per PwC) have adopted generative AI in some form in the past twelve months, and two thirds of UK organisations cannot tell whether their employees are pasting sensitive material into those tools. The biggest risk for most enterprises this year is not a foreign intelligence service. It is a contract, a supplier quote, or a customer list being uploaded to a chatbot by someone who is just trying to get their work done faster.
If your threat model still treats the network perimeter as the line of defence, you have already lost the argument. The action moved to the browser tab, and most security teams have not caught up.
The Shadow AI problem is really an identity problem
Shadow AI (the term Bradford uses for unsanctioned use of public AI tools by employees) looks like a tooling gap on the surface. It is not. It is an identity gap, because the thing that needs to be governed is not the network path, it is the person, the prompt, and the data leaving with the prompt.
When someone pastes a vendor agreement into ChatGPT or Claude to “summarise the indemnity clauses,” several things happen that a traditional firewall cannot see:
- The contract leaves the corporate environment, even if the employee did not realise it.
- The model’s training and retention policies take over, and most enterprises have not read them carefully.
- If the prompt includes credentials, access tokens, or anything that looks like a system identifier, those now live in a third party log file that the enterprise does not control.
This is the trap. The intent is innocent, the action feels small, and the consequences can be measured in regulatory fines and customer churn rather than in megabytes.
Why pilots fail and people route around them
Most enterprises have tried the polite fix first: a private, gated LLM, rolled out as a pilot. The numbers are not flattering. McKinsey’s data quoted in the piece puts nearly two thirds of organisations stuck at the pilot stage, never scaling. Bradford’s own number is harsher: 35% of UK businesses admit employees are still sharing data through external tools, because the approved one is slower, dumber, or both.
That is the whole story of Shadow AI in one paragraph. Employees have a productivity problem. The approved tool does not solve it. The unapproved tool does. People vote with their browser tab.
What a real fix looks like
Telling employees to stop is not a fix. Mandatory training is not a fix. The fix is the boring infrastructure work that nobody wants to budget for. Three things matter:
- Real-time visibility at the browser and application layer. Not monthly log review. Real-time, with the ability to see what was uploaded, by whom, to which model.
- Automated redirection. When someone tries to upload a sensitive document to a public model, the system catches it, blocks the upload, and offers the approved alternative on the same screen. If the approved tool is faster than the public one, people will use it. If it is not, they will not.
- An agent ledger. This is the new bit. As employees start using AI agents that themselves call other agents, the enterprise loses the chain of custody on its data. A ledger that records every agent interaction, with least-privilege grants that expire, is the only way to keep the picture whole.
The honest version of this is that the technology exists. The budgets, the procurement cycles, and the internal politics are what is slowing it down.
Trade-offs
Every option on the table has a cost, and pretending otherwise is how enterprises end up with surprise regulatory letters.
- Visibility tools give you signal, but they also create a workforce surveillance narrative that HR and legal will not love. The cleanest way through is to publish the policy openly, scope it to high-risk data classes, and keep it out of performance reviews.
- Browser-level controls are powerful but they tend to break on edge cases. If the rule is “block uploads to ChatGPT,” somebody will find a copy-paste workflow that the rule does not catch within a week.
- Gated private models are the right answer for regulated workloads, but they will not match the public models on raw capability for a while. Telling people they have to use the slower tool and not explaining why is the fastest path back to Shadow AI.
- Agent ledgers are necessary, but they are a new category. The vendors selling them are mostly the same identity vendors who sold you IGA (identity governance and administration) five years ago, with some new dashboards bolted on. Expect to be a beta tester.
The mistake is to pick one of these and call it done. The realistic answer is all of them, layered, with clear ownership for each layer. Security does the visibility and the block rules. IT runs the gated model. The identity team owns the agent ledger. Each function has a defined boundary, and the boundaries are tested.
What to do this quarter
If you are starting from zero, the work is sequenced. Pick the highest-risk data class first. For most enterprises that is customer PII (personally identifiable information) or anything that touches regulated reporting. Instrument browser-level visibility for that one class. Run the policy for a month. Measure how often it fires, and what employees were actually trying to do. Use that data to write the next policy.
Then expand the scope, one class at a time. Resist the urge to write a 40-page AI policy that nobody reads. The point of this exercise is to change behaviour, not to satisfy an auditor.
The threat actors are real. They are also, for most enterprises, a distraction from the immediate, daily, low-grade data leakage happening in their own browser tabs. Fix that first.
What an audit of Shadow AI looks like in practice
If you have never run this kind of audit, the shape of it is straightforward, and the surprises are usually about volume rather than severity. The first pass tends to surface three patterns:
- The “summarise this contract” pattern. Legal, procurement, and sales operations staff paste full document text into a public LLM to get a one-paragraph summary before forwarding it on. The data classification here is usually confidential, and the act is rarely logged anywhere.
- The “rewrite this email” pattern. Customer success and account management staff paste customer correspondence into a chatbot to adjust tone. The risk is lower for tone-rewrites than for content uploads, but the same prompt sometimes includes account identifiers or contract numbers.
- The “build me a script” pattern. Engineering and IT staff paste internal code snippets to ask for refactors or test scaffolding. The risk depends entirely on what is in the snippet, but proprietary algorithms and unreleased product names show up more often than anyone expects.
The audit output is rarely a smoking gun. It is usually a long tail of low-grade disclosures, hundreds per week across a mid-size enterprise, that nobody noticed because nobody was looking. The policy work that follows is about reducing that tail, not about catching individual offenders.
The communication problem nobody wants to own
The hardest part of a Shadow AI programme is not the tooling. It is the internal communication. Most employees do not know that pasting a vendor agreement into ChatGPT creates a compliance exposure. They think of it as a faster search engine. Telling them otherwise without sounding accusatory is the work.
These patterns work:
- A short, plain-English policy that names the high-risk data classes and explains why they are high-risk. Three pages, not thirty.
- A peer-led briefing where a respected engineer or lawyer walks through one real anonymised example of what went wrong. Employees trust practitioners more than they trust memos from the CISO (chief information security officer).
- A clear path to the approved alternative. If the gated private model is slower or dumber than the public one, the policy will be ignored. The investment in the approved tool is part of the compliance programme, not separate from it.
- A feedback loop. Let employees flag the cases where the approved tool does not do what they need. Route those flags to the team that owns the tool. The fastest way to lose employee trust is to publish a policy and then not respond to its consequences.
The mistake is to treat Shadow AI as a security problem and communicate it as one. It is a productivity problem with a security consequence. Framing it that way to employees changes the conversation.