It starts as a tiny shortcut.
A PM installs a browser extension that promises to "summarize customer emails." It works. Of course it works. It also ships the full email thread to someone else's servers so it can do the summarizing. Attachments too, if you're lucky.
That's shadow AI. It's shadow IT with better marketing and worse instincts.
Shadow AI isn't one tool. It's a habit.
Most people picture "AI risk" as a big vendor contract and a long security review. That's not what bites you.
Shadow AI shows up in small, quiet places:
- Browser extensions that read whatever tab you're on: support inboxes, CRMs, internal dashboards
- VS Code plugins that index your repo "for better completions"
- Random SaaS "copilots" wired into Slack, Notion, Jira, Gmail
- Personal chatbots where someone pasted internal docs "just to test"
- Public playgrounds where someone dumps production logs because "it's just text"
I’ve seen the same pattern at a SaaS company that sold AI-powered financial automation that was actually spreadsheet column mapping and humans doing the hard parts. The messy part wasn’t the tech. It was people routing around the official process to get work done cheaper and faster.
Shadow AI is that same routing behavior. Just with more ways to leak things.
Why "ban it" fails
If you say "no AI tools," you're telling people to hit the same deadlines with fewer tools while everyone else moves faster. They will ignore you. Quietly.
Engineers, PMs, support, sales, doesn’t matter. They have tickets, quotas, SLAs, and customers typing in all caps.
So the goal isn't to eliminate shadow AI. The goal is to make the shortcuts safe enough that they don't leak data or break contracts.
Step one: figure out what people are using (without making them defensive)
You need visibility into what's already happening.
Things that work better than a scary all-hands from security:
- Anonymous surveys: "What AI tools do you actually use every week?"
- Telemetry where it makes sense: proxy logs, SSO app catalogs, endpoint management
- Browser extension scanning if your environment allows it
- A "Bring your AI" session: show the tool, what you use it for, and what data you feed it
That last one sounds goofy, but it shifts the tone. It turns "confession" into "show-and-tell." People will be honest if you don’t punish them for trying to ship work.
Build an approved AI toolkit (so people stop shopping in the dark)
If you don’t provide a safe default, people will assemble their own stack from random Chrome extensions and free tiers.
An approved toolkit should cover the boring jobs people actually have:
- Drafting customer replies (with safe templates)
- Code assist inside your IDE
- Summarizing long docs and tickets
- Basic analytics help (SQL, charts, explanations)
For each approved tool, write down what you can promise in plain language:
- Data retention: how long it’s stored
- Training: whether your data is used to train their models
- Access control: SSO, RBAC, audit logs
- Where data goes: region, subprocessors, export controls
Also: have a tool request path with a real turnaround time. If the answer always takes six weeks, the real policy is "people will install whatever Chrome extension shows up first in search."
Guardrails for the gray area (the copy‑paste zone)
Most problems won’t come from a hacker. They’ll come from someone pasting the wrong thing into the wrong box.
Give rules people can actually remember:
- No production secrets (keys, tokens, certs)
- No PII/PHI
- No full database dumps
- No raw customer email threads unless the tool is explicitly approved for it
"Don’t paste sensitive data" is useless. Get concrete.
Patterns that help:
- Snippet-length limits (for example: max 20–30 lines of code)
- Masking examples in internal docs:
- Replace emails with
user@example.com - Replace IDs with
acct_123 - Replace API keys with
sk-REDACTED - A sanctioned internal page: "Safe prompts for support," "Safe prompts for code review," etc., with copy‑paste examples
Engineers will follow a rule if you give them a button to copy from.
A tiny example
Instead of pasting this:
Customer: Jane Smith <jane@bigbank.com>
Account: 983274
Issue: Payment failed on invoice INV-88219
Logs: ...full stack trace...
Paste this:
Customer: [REDACTED_EMAIL]
Account: [REDACTED_ACCOUNT_ID]
Issue: Payment failed on invoice [REDACTED_INVOICE_ID]
Logs: [PASTE ONLY THE RELEVANT ERROR LINES, NO TOKENS]
Annoying? Yes. Still cheaper than explaining to legal why some browser plugin now has a copy of your customer list.
Governance that doesn't kill experimentation
You don’t need a council of elders. You need a path that doesn’t feel like punishment.
- Pick a few team AI champions (helpers, not hall monitors)
- Run office hours with security and engineering in the same room
- Track a small set of metrics:
- adoption of approved tools
- new tool requests
- incidents and near-misses
If you only track violations, you train people to hide. Track adoption and improvements. Reward boring compliance.
Shadow AI is a symptom. People are moving faster than your process. Fix the process, and the shadows shrink.
For teams building their own AI tools or securing developer-facing AI code assistants and CI bots, the same principle applies: give people safe defaults and clear lanes before they reach for risky shortcuts.
-Sethers
