A new report puts a number on something many small business owners already suspect: employees are signing up for AI tools faster than anyone can track them. Security firm Reco found that roughly 80 percent of AI tools used inside companies can be deployed without any IT department ever knowing. That gap has a name — shadow AI — and it's the latest version of a problem businesses have dealt with for over a decade.
The pattern is familiar. Cloud storage, messaging apps, and project management software all went through the same phase: an employee finds a free or cheap tool, starts using it to solve an immediate problem, and nobody loops in IT because there's no formal process requiring it. The difference with AI tools is what gets fed into them. Where shadow software once meant an unauthorized file-sharing link, shadow AI often means customer records, financial data, or internal strategy documents typed directly into a chatbot or AI-powered app.
The mechanics are simple enough to explain why oversight breaks down so easily. Many AI tools, especially browser extensions and lightweight apps, require only a personal email to sign up. No procurement process, no IT ticket, no review. An employee trying to draft a contract faster or summarize a pile of customer emails can have a tool running in minutes, with no one else in the company aware it exists.
This isn't a hypothetical risk. IBM's long-running annual breach research has consistently found that incidents involving ungoverned or unauthorized tools cost more to detect and contain than breaches involving sanctioned systems, partly because security teams don't know to look for them. The same dynamic now applies to AI: a tool nobody approved is a tool nobody is monitoring for data leaks, retention policies, or who else can see what gets typed into it.