Shadow AI

Shadow AI is the AI equivalent of shadow IT: staff using models and assistants through unsanctioned paths - a consumer chatbot in a browser, a personal API key, an unapproved plugin - outside whatever governance the organization has set up. It is rarely malicious; people reach for the fastest tool. But it means sensitive data flows to models no policy is watching.

Shadow AI is the egress to close first, because a boundary only governs the traffic that passes through it. Making the sanctioned path the easy path - and giving security a clear view of which consumption is gated versus unmonitored - is how shadow usage gets pulled back in front of policy, rather than discovered after a leak.