Shadow AI: The Hidden Data Leak in Your Business

Ryan Haylett

Picture last Tuesday, quarter to five. Someone on your team is staring at a spreadsheet of three hundred customers that is a complete mess. So they open a free ChatGPT account, on their personal login, paste in all three hundred rows, and forty seconds later it's clean. They go home on time. You never know it happened. And here's the thing, they weren't being sneaky. They were being efficient.

Dave Rowley

That's what makes this tricky. A lot of owners tell themselves, we don't use AI, we never bought anything. But UpGuard's 2025 research found that 81 percent of employees use unapproved AI tools on the job. Menlo Security found 68 percent use free tier tools through personal accounts, and 57 percent admitted to putting sensitive data into them. So the question isn't whether your business uses AI. It's whether you know where.

Ryan Haylett

There's a name for it. Shadow AI. It just means employees using AI tools for company work that nobody approved or set up. Personal ChatGPT, Claude, or Gemini logins. Browser add-ons. Meeting recorder bots that join your calls. All of it is happening outside your view.

Dave Rowley

And I want to explain why this isn't the same as someone using an unapproved file sharing account. If a person saves a file to the wrong folder, that's a problem, but it's a contained one. You can shut off the login, delete the files, and it's done. With a consumer AI tool, the text gets sent to the provider's servers, it sits in prompt logs, and in many cases it can be kept and used to train future versions of the model. Depending on the settings, you can't pull it back. You can't audit it. It's like sending a postcard and then realizing you can't ask the mail carrier to return it.

Ryan Haylett

Samsung is the example everyone cites. Engineers pasted proprietary chip data into a consumer chatbot to fix errors. Nobody was trying to leak anything. They were trying to debug faster. And the browser add-ons are the quieter version of this. A grammar checker or a summarizer that asks for permission to read every page you visit can see your customer records, your email threads, your accounting dashboard, whatever happens to be open in the next tab.

Dave Rowley

That's the part I'd push owners on. Everybody thinks about the chat window. Nobody thinks about the little extension they installed eight months ago because it promised to make emails sound nicer.

Ryan Haylett

So why does this hit the bottom line? Start with money. IBM's 2025 breach cost report found that organizations with a high level of shadow AI paid about 670,000 dollars more when they had a breach. And the research summaries pass along a detection time of around 247 days, which, if accurate, means information could be flowing out for the better part of a year before anyone notices.

Dave Rowley

Then there's the legal side. If you run a medical or wellness practice, healthcare privacy law, the one people call HIPAA, expects a signed agreement with any vendor that touches patient information. A free chatbot account doesn't come with one. If you're a law firm or an accountant, pasting a client's documents in probably breaks your confidentiality promises. And for anybody with proprietary pricing or bidding formulas, trade secret protection depends on making reasonable efforts to keep them secret. Pasting them into a public tool arguably undercuts that.

Ryan Haylett

Two more. Cyber insurance carriers are reportedly adding AI questions to renewal forms, and if you've got no written policy, that's an awkward conversation to have after an incident. And then there's plain old quality. AI can sound completely confident while being wrong. If somebody drops a made up number into a customer quote, that's on you.

Dave Rowley

So what do you actually do? First, don't ban it. It's tempting, but bans don't stop the usage, they stop your visibility. People just move to their phones and personal laptops, and now you can't see anything at all.

Ryan Haylett

Right. Second, give people a simple traffic light for data. Green is safe: brainstorming, public marketing copy, an email outline with no client names in it. Amber means company accounts only, like internal project plans or data with the identifying details removed. Red means client records, financial spreadsheets, patient details, anything under a nondisclosure agreement. Those need dummy numbers or your written okay. And then there's a fourth category that's just off limits, period: passwords, security codes, bank account numbers, card numbers.

Dave Rowley

Third, give everybody a real option. Set up named company accounts, one per person, not a shared login. And turn off the setting that lets the provider train on your data, wherever that setting exists. If the sanctioned tool is easy, nobody goes hunting for the sketchy one.

Ryan Haylett

Fourth, a human signs off. AI drafts, a named person checks every number, every factual claim, and anything going to a customer before it goes out. That one rule catches the embarrassing mistakes.

Dave Rowley

Now, quick wins for this week. One, run an amnesty. Fifteen minutes, three questions, zero blame. What AI tools are you using, which accounts are you logged into, and what browser extensions have you installed? Say out loud that nobody is in trouble. You'll get honest answers precisely because you said that.

Ryan Haylett

Two, a five minute audit. Look through browser extensions for anything that can read the content of every page, and remove what you don't need. Then check the settings on the tools people are actually using and switch off data sharing for training.

Dave Rowley

Three, one page. Put the green, amber, and red rules on a single sheet, hand it out, and have people sign it. It also gives you something to show when an insurance form asks whether you have an AI policy.

Ryan Haylett

The takeaway is this. The technology isn't the threat. Ungoverned technology is. Your team is already using AI because it makes their day easier, so don't fight that. Give them guardrails, so they can move fast without betting your customers' information on it. And if you want help setting up practical, secure tools like this in your business, you can learn more at modularity.us.