Topic

Shadow IT

Shadow IT refers to information technology systems, applications, and services that are used within an organization without the knowledge or approval of the IT department or governance teams. In the context of AI governance, shadow IT becomes increasingly problematic as employees deploy unapproved AI tools, datasets, and models that lack proper security controls, compliance oversight, and risk assessment. Organizations must address shadow IT to prevent data breaches, ensure regulatory compliance, maintain consistent AI quality standards, and avoid blind spots in their AI inventory and risk profile.

1 item

ResearchUS2026-04-19

82% of Top 100 GenAI SaaS Tools Rated Medium to Critical Risk as Employees Routinely Enter Sensitive Data, Cyberhaven Labs Finds

Cyberhaven Labs released its 2026 AI Adoption and Risk Report on February 5, 2026, drawing on analysis of billions of real-world data movements across generative AI SaaS platforms, endpoint AI applications, and AI agents used in enterprise environments. The report finds that 82% of the top 100 GenAI SaaS tools are classified as medium to critical risk, and that employees are entering sensitive data into AI tools on average once every three days. A significant shadow IT dimension is documented: 32.3% of ChatGPT usage and 24.9% of Gemini usage occurs through personal accounts rather than corporate-managed accounts, placing that activity outside enterprise data governance controls. For compliance teams, the findings underscore a structural gap between the pace of AI adoption and the maturity of data loss prevention, acceptable use policies, and third-party risk management programs. Organizations lacking visibility into AI tool usage at the endpoint level may face exposure under data protection obligations in multiple jurisdictions, including the EU AI Act, various US state privacy laws, and sector-specific regulations governing sensitive data handling.

Cyberhaven ChatGPT Gemini OpenAI Google EU AI Act EU United States shadow IT data governance data loss prevention third-party risk management transparency enterprise AI risk