How big a problem is shadow AI in large enterprises today?

Shadow AI, meaning employees using AI tools, browser extensions, or autonomous agents without formal approval from IT or security, has become one of the fastest growing blind spots in enterprise security. It mirrors the shadow IT problem that emerged during the early cloud era, where employees adopted SaaS tools independently of procurement, but the stakes are higher this time because AI tools frequently process sensitive text and documents directly as part of how they function.

Most security teams currently have limited or no visibility into which AI tools are actually in use across their workforce. A browser extension that summarizes documents, a personal account with a coding assistant, or a free tier chatbot used to draft internal communications can all be pasting sensitive company information into third party systems with data retention policies nobody on the security team has reviewed. Unlike shadow IT tools, which usually required at least some procurement interaction, many shadow AI tools can be adopted with a single click and no organizational footprint at all.

The scale of this problem tends to surprise organizations once they actually measure it, since usage is rarely limited to a handful of employees experimenting on their own. It often spans entire departments once one team discovers a useful tool and shares it informally with colleagues, all without security ever being aware it is happening.

Akto's Atlas product is built specifically to address this gap, discovering AI tool and agent usage across an organization and applying guardrails without requiring a full lockdown of AI adoption, which tends to be a more realistic path forward than trying to ban usage outright.