Shadow AI — unsanctioned use of AI tools — is pervasive across every sector. Technology leads at 82%, but even government agencies report 47% unauthorized AI usage. The gap between IT awareness and actual employee behavior is the single largest blind spot in enterprise security today.

ChatGPT remains the most widely used unsanctioned AI tool at 84% of enterprises, followed by Copilot (67%), Gemini (52%), and Claude (41%). Image generators and specialized coding assistants round out the top tier.

AI-related data leakage incidents have surged sharply over the past 12 months. Data transfers to AI/ML applications surged 93% in 2025, totalling more than 18,000 terabytes — an expanding target for cybercriminals, according to Zscaler ThreatLabz 2026. Source code (34%) and customer data (28%) remain the most commonly exposed data types. Most incidents stem from employees pasting sensitive information into general-purpose AI chat interfaces.

According to the IBM Cost of a Data Breach Report 2025, 63% of organizations lacked AI governance policies to manage AI or prevent the proliferation of shadow AI. Only 10% have policies that are actively enforced and audited. The gap between stated intent and operational governance remains the defining challenge for enterprise security leaders in 2026.

Despite growing awareness, only 18% of enterprises have deployed dedicated AI governance or monitoring tools. Most rely on existing DLP solutions (34%) that were not designed for AI-specific risks, while 48% have no tooling at all.

Only 21% of enterprises provide formal AI security training to employees. Meanwhile, 67% of employees report learning to use AI tools through self-study or peer sharing — with zero security guidance.

As regulatory frameworks like the EU AI Act, NIST AI RMF, and ISO 42001 take shape, most enterprises are unprepared. Only 8% report full readiness for any major AI compliance framework.

For every $1 spent on sanctioned AI tools, enterprises unknowingly spend an estimated $0.40 on unsanctioned AI subscriptions and usage. This "shadow AI tax" represents a massive blind spot in both budgets and security postures.

Data exfiltration via AI tops the list of CISO concerns (78%), followed by compliance risk (65%), IP leakage (61%), and model poisoning / supply chain attacks (44%). Critically, 97% of organizations that reported an AI-related security incident were found to have lacked proper AI access controls at the time of the breach (IBM, 2025) — underscoring that concern alone is insufficient without active governance.

The AI governance and security tooling market is projected to grow from $1.2B in 2024 to $8.7B by 2028 — a 7.3× increase. Enterprises are beginning to recognize that AI-specific security is no longer optional.