IBM Cost Report

Software Vendors Embed Shadow AI Controls to Counter Unauthorized GenAI Use

Employees increasingly rely on unapproved generative AI tools, causing sensitive business data to flow to external servers without IT oversight. The Verizon Data Breach Investigations Report 2025 indicates that around 15 percent of staff regularly access GenAI services via corporate devices, with 72 percent using private email accounts. Blanket bans prove ineffective as workers bypass restrictions via personal devices or hotspots, pushing the industry toward built-in visibility and governance features instead. Vendors now integrate data loss prevention, policy enforcement, audit trails, and secure AI gateways directly into their platforms while treating LLMs as standard endpoints under Zero Trust models. The EU AI Act Article 4, effective since February 2025, requires organizations to ensure staff competence in AI usage, with non-compliance risking fines. IBM’s Cost of a Data Breach Report 2025 links Shadow AI incidents to an average of $670,000 higher breach costs. Experts recommend combining technical controls with clear governance, approved alternatives, and ongoing employee training to convert the risk into a managed capability.