Shadow AI Statistics 2026: 17 Data Points Every Security Leader Should Know

Shadow AI adoption isn't a fringe behavior anymore: large workforce surveys and monitored-prompt datasets show that unauthorized tools and sensitive-data exposure are widespread. Below are 17 statistics on shadow AI adoption, what employees are sharing with unsanctioned tools, and what it costs when things go wrong, drawn from research by PagerDuty (Wakefield Research), Pew Research Center, Microsoft, IBM, and Harmonic Security.

How to read these statistics

These figures describe different populations and should not be combined into one universal shadow-AI rate. PagerDuty's numbers come from a commissioned survey of 1,250 non-IT office professionals at large companies across four countries. Microsoft surveyed knowledge workers who already use AI. Pew measured U.S. adults. Harmonic analyzed prompts observed in its customer telemetry, and IBM studied 600 organizations that had already experienced a breach.

Each source answers a different question: reported employee behavior, observed prompt content, or breach impact. Surveys can be affected by wording and self-reporting; vendor telemetry reflects the vendor's customer base and detection methods; breach studies show association, not proof that shadow AI alone caused an additional cost. The useful signal is the repeated direction across datasets—not a single percentage applied to every organization.

Adoption: how many employees actually use unsanctioned AI

• 66%of office professionals have used an AI tool at work despite believing their company's policy prohibited it. The finding comes from a survey of 1,250 non-IT professionals at companies with $500M+ annual revenue across the US, UK, Australia, and Japan. — PagerDuty / Wakefield Research, 2026
• 89%of those unauthorized users first discovered the AI tool in their personal life, then brought it into work. — PagerDuty / Wakefield Research, 2026
• 28%of employed U.S. adults say they use ChatGPT specifically for work — up from 20% in 2024 and just 8% in 2023, roughly tripling in two years. — Pew Research Center, June 2025
• 78%of people who use AI at work "bring their own AI" (BYOAI) rather than using an employer-provided tool — rising to 80% at small and mid-size companies. Based on 31,000 knowledge workers surveyed across 31 countries. — Microsoft and LinkedIn Work Trend Index, 2024
• 52%of employees who use AI at work say they hesitate to disclose it when it's involved in a critical task. — Microsoft and LinkedIn Work Trend Index, 2024

What employees are actually sharing with unsanctioned tools

• 88%of office professionals in the PagerDuty survey said they've shared work-related information with a public AI tool such as ChatGPT, Claude, or Gemini. — PagerDuty / Wakefield Research, 2026
• 43% / 40% / 34% / 31%of surveyed office professionals shared emails or correspondence, meeting notes or summaries, customer data, and financial or confidential documents, respectively. — PagerDuty / Wakefield Research, 2026
• 71.2%of all sensitive-data exposure events across 22.4 million monitored enterprise AI prompts in 2025 were attributable to ChatGPT alone. — Harmonic Security, 2026 analysis of 2025 prompts
• 2.6%of the 22.4 million prompts analyzed contained sensitive company data — 579,113 individual exposure instances over the year. — Harmonic Security, 2026 analysis of 2025 prompts
• 26.5% / 22.3% / 16.6% / 12.6%of exposed sensitive content was code, legal data, financial data, and M&A materials, respectively — together 78% of detected exposure instances. — Harmonic Security, 2026 analysis of 2025 prompts

What it costs when shadow AI leads to a breach

• $670,000in additional average breach cost at organizations with high shadow AI use, compared to those with little or none. Based on interviews with 600 breached organizations between March 2024 and February 2025. — IBM Cost of a Data Breach Report, 2025
• 1 in 5of the breached organizations in IBM's study reported a breach involving shadow AI. This is not one in five organizations overall. — IBM Cost of a Data Breach Report, 2025
• 97%of organizations reporting a breach of an AI model or application lacked proper AI access controls. The denominator is the subset reporting an AI-related breach. — IBM Cost of a Data Breach Report, 2025

The governance gap

• 63%of breached organizations either had no AI governance policy or were still developing one. — IBM Cost of a Data Breach Report, 2025
• 34%of organizations with an AI governance policy regularly audit for unsanctioned AI. — IBM Cost of a Data Breach Report, 2025
• 81%of employees believe company leadership operates under a different set of AI rules than everyone else. — PagerDuty / Wakefield Research, 2026
• 77% / 75%believe their company’s AI restrictions are holding back their professional growth, and would consider leaving for a job with better AI tooling, respectively. — PagerDuty / Wakefield Research, 2026

What these numbers mean for security teams

Three things fall out of this data pretty consistently. First, shadow AI is widespread, not an edge case — treating it as a rare policy violation can materially understate the exposure. Second, the risk is concentrated: a small number of tools (ChatGPT foremost among them) and a small number of data categories (legal, code, financial) account for most of what's actually exposed, which means detection doesn't have to solve for every possible tool on day one. Third, the gap isn't awareness — most employees know they're not supposed to be doing this — it's that policy without a technical control point doesn't change behavior at the moment it matters. That's the approach ContextGuard's platform takes: discovery and enforcement in the same policy engine, not two separate tools.

For the underlying mechanics of what shadow AI is and how governance programs address it, see What Is Shadow AI?

Shadow AI statistics FAQ

How common is shadow AI at work?

There is no single universal rate. In the PagerDuty survey, 66% of 1,250 non-IT office professionals at large companies said they had used AI at work despite believing company policy prohibited it. Other sources measure different populations, so their percentages should not be combined.

How much can shadow AI add to breach costs?

IBM's 2025 study associated high shadow AI use with $670,000 in higher average breach costs among 600 breached organizations. That is an association within an already-breached population, not proof that shadow AI alone caused the difference.

Are these shadow AI statistics globally representative?

Not as one combined dataset. The sources use different countries, populations, customer bases, and methodologies. They are most useful as directional evidence when each denominator and limitation remains attached to its statistic.