djinn six icon
djinn six®

The Sixth Layer

← Back to blog
AI Security

Shadow AI is now a national security judgement

Allen Clark

Allen Clark

An office worker, seen from behind, sits at a desk in an open-plan office at night with a laptop of spreadsheets and a phone showing a chatbot. Document pages drift from the laptop towards the phone and out through the window, while colleagues in a glass meeting room behind are also on their phones.

For a couple of years shadow AI has almost been treated as a policy problem. Someone writes an acceptable use note, IT blocks a few websites and everyone moves on. This week the NCSC categorised it differently in its Annual Review 2026.

The NCSC lists shadow AI among its key judgements on how AI is changing the threat, alongside AI-assisted exploit development and AI malware in attacks on critical infrastructure. The wording is very direct:

"It is highly likely the use of 'shadow AI' will leave the cyber security of an organisation open to exploitation from advanced persistent threat groups and cyber criminals."

That puts staff pasting work into a personal chatbot in the same assessment as nation-state hacking groups.

How common it is

The numbers suggest most organisations already have the problem. Research for Microsoft UK by Censuswide, with 2,003 UK employees surveyed in October 2025, found 71% had used unapproved consumer AI tools at work and 51% did so every week. Only 32% said they were concerned about the privacy of company or customer data they put into those tools. 28% said their employer didn't offer an approved option.

Research by TrustedTech, published in May 2026 from 2,000 employees in the UK and US, found the habit is strongest at the top. 62% of UK senior leaders use unapproved AI tools, against 31% of staff below decision-maker level. 22% of employees said they would keep using them even if they were banned and disciplinary action was possible, rising to 28% among senior decision-makers.

The people responsible for security often can't see it either. Pentera surveyed 300 US security leaders in December 2025 and not one of them said they had full visibility of how AI was being used in their organisation, while two thirds said they had limited visibility or none at all. Lisa Ventura made the same point this week in a piece on why AI security so often has no owner.

Shadow AI at work: who is using it". 71% of UK employees have used unapproved AI tools at work. 62% of UK senior leaders use unapproved AI tools. 51% of UK employees use them every week. 31% of UK staff below decision-maker level use them. Sources: Microsoft UK and Censuswide, October 2025, 2,003 UK employees; TrustedTech, May 2026.
Most UK employees have used AI tools their employer hasn't approved, while senior leaders are twice as likely to do it as their staff. Sources are Microsoft UK and Censuswide (October 2025) and TrustedTech (May 2026).

So the people most likely to be using shadow AI are the ones who sign off the policy against it. A ban on its own is unlikely to change much.

It is already causing breaches

This isn't a theoretical risk. IBM's 2025 Cost of a Data Breach Report, based on 600 organisations breached between March 2024 and February 2025, found that one in five had suffered a breach due to shadow AI. Organisations with high levels of shadow AI saw breach costs $670,000 higher on average than those with little or none. Those incidents exposed more personal data (65% against 53%) and more intellectual property (40% against 33%) than the average breach. Only 37% of organisations had policies to manage AI or detect shadow AI. Of those with a policy, only 34% audited for unsanctioned AI.

The UK figures in the same study were no better. 63% of UK organisations that responded had no AI access controls in place and only 31% had AI governance policies.

The Netherlands has a public example. In October 2025 the municipality of Eindhoven found, in a check covering 23 September to 23 October, that staff had uploaded files containing personal data about residents and colleagues to public AI websites, reportedly including CVs and youth care files. It reported the breach to the Dutch data protection authority, blocked public AI sites, moved staff onto Copilot inside its own environment and asked OpenAI to delete the files. Because the AI sites kept the data for only 30 days, the council couldn't tell how much had gone before that window. The regulator has since said it received dozens of breach reports of this kind in 2025, more than the year before, usually from staff using chatbots on their own initiative.

The part of the judgement that gets missed

Most coverage of shadow AI is about data leaving the building and the NCSC covers that too. The NCSC report says that moving company data onto personal devices to use these tools

"almost certainly means organisations will lose visibility of how the information is handled and who can access it".

The second half of the judgement interested me more. The NCSC says it is likely organisations

"will lose sight of their workforce's competency in cyber security if the tasks are frequently outsourced to shadow AI".

That's a different kind of risk. If people hand their judgement to a tool nobody has approved, the organisation no longer knows what its staff can do without it. Nobody has checked what the tool gets wrong. A sanctioned AI system can at least be tested before it is trusted with real decisions and again when its model changes whereas an unsanctioned one has never been tested at all. Nobody even knows it is part of the process.

Diagram titled "Same task, two routes". A member of staff at a laptop has two arrows. The top arrow leads to an approved AI tool, which is logged and access-controlled, keeps data within agreed terms and is tested before use and after model changes. The bottom arrow leads to a personal chatbot account, which has no logs the organisation can see, unknown retention and training use, and has never been tested.
The same piece of work can go two ways. Through an approved tool it is logged, controlled and tested, while through a personal chatbot account nobody can see where the data went.

What should you do about it

The research points to a few practical steps.

  • Find out what is actually in use. Before writing more policies know what the landscape is and what your staff are actually using on a day-to-day basis. Proxy and DNS logs, OAuth grants to AI apps and installed browser extensions will tell you far more than a staff survey. The answer is usually bigger than expected.
  • Give people an option. Have a sanctioned option that is good enough to use. Microsoft's own research found people turn to consumer tools largely out of habit or because nothing is provided. The figures on bans suggest that blocking without an alternative mostly drives the use further out of sight.
  • Test the sanctioned tools properly. Bringing shadow AI into the light only helps if the approved route has been tested for what it will leak, what it can be talked into and how it behaves when the model behind it changes. Otherwise the organisation has just swapped an unknown risk for an approved one.
  • From the top down. Start with the senior team. If leaders are twice as likely to use unapproved tools as their staff, that is where the conversation needs to begin.

The NCSC has made this a security issue rather than a housekeeping one. How many boards could say today which AI tools their own members used last week?

Sources

← More insights from djinn six
    Shadow AI is now a national security judgement | djinn six