Shadow AI drives security incidents at 58% of firms as workers bypass approved tools

Shadow AI Creates Widespread Security Incidents Across Organizations

More than half of businesses faced an AI-related security incident or near miss in the past 12 months, according to research commissioned by Okta, the identity and access management leader. The AI Agents at Work 2026 report, conducted by Apprize360 in March, surveyed 292 executives and 492 knowledge workers across seven countries including the US, UK, Australia, Canada, Japan, France, and Germany 1

1

. Of the 58% who reported AI security risks, 26.7% described an actual incident involving a breach, data exposure, or system disruption, while 31.2% identified a close call caught before it caused harm. The culprit behind these incidents is shadow AI, where employees use unapproved AI tools without organizational oversight or security controls.

Employees Using Personal AI Accounts for Work Create Visibility Gap

Research from Harmonic reveals that 64.5% of all activity on personal and free AI accounts is actually for work purposes, creating a massive visibility gap in AI usage that organizations cannot detect or control 2

2

. Nearly half (45.6%) of all personal AI activity happens on licensed plans paid for by companies, yet workers treat work AI and personal AI interchangeably, bringing tasks to whichever tool is already open or easily accessible. Knowledge workers admit to sharing confidential data with these tools, handing over HR information, and in 16% of cases, providing their login credentials to AI systems 1

1

. This behavior increases the attack surface across organizations and creates permanent intellectual property loss when sensitive company information remains in personal AI history even after employees leave.

Executive Confidence Masks Dangerous Reality of Employee AI Use

Despite widespread shadow AI adoption, 90% of executives expressed confidence in their organization's visibility into AI tools, revealing a stark disconnect between leadership perception and employee reality 1

1

. The Okta survey found that 52% of knowledge workers admit to using unapproved AI tools, with 24% doing so regularly. The gap between executive confidence and employee reality is widest in the UK, where 96% of executives expressed confidence in their AI visibility while more than half of workers used unauthorized tools. Geographic variations are significant: 67% of US workers use unsanctioned AI tools, followed by Australia at 60%, the UK at 55%, and Canada at 50%. France and Germany reported the lowest rates at around 30% each 1

1

.

Data Security Concerns Mount as Usage Patterns Reveal Deep Engagement

Harmonic's research uses minutes rather than total queries to measure true AI engagement, revealing that workers spend an average of 10 minutes and 12 seconds per session on Claude, compared with 5 minutes and 53 seconds on ChatGPT 2

2

. These longer sessions indicate heavier data exposure and greater risk when conducted on personal accounts. Legal and governance workers show both the highest usage and highest visibility, accounting for 19.5% of all AI hours across teams, with 81% happening on approved tools. However, go-to-market teams present a concerning pattern: they're the second-highest users at 17.5%, but only 39% of their AI activity happens on company-approved tools. Operations teams face even worse visibility, with less than 18% of activity running on enterprise AI tools 2

2

.

AI Governance Frameworks Needed as Bans Push Usage Underground

Harish Peri, SVP and GM for AI Security at Okta, emphasizes that organizations cannot protect what they cannot see, and strict AI bans may actually worsen the problem by pushing more usage underground 1

1

. Security and compliance teams cannot govern the usage of AI tools they don't know are being used. Organizations must implement effective AI governance frameworks that prioritize identity-centric controls, automated discovery, and secure sandboxes to test drive AI tools safely. The challenge stems from clunky enterprise authentication processes that make personal tools far easier to access than approved alternatives. Popular tools like ChatGPT, Gemini, Claude and Perplexity require little more than a Google account to sign in, while enterprise AI tools demand strict authentication 2

2

.

Organizations Pay Premium for Underutilized Licensed Tools

Companies are pouring money into AI licenses that barely get used while employees default to personal accounts. Microsoft 365 Copilot is commonly deployed at $30 per user per month, while ChatGPT Business plans cost $20-25 per month 2

2

. Harmonic Security CEO Alastair Paterson notes that "every organization is pouring money into AI right now, and almost none of them know what their people are actually doing with it." The path forward involves making secure AI use the easiest path through universal single sign-on to simplify access, while challenging the one-size-fits-all approach by giving the right tools to the right teams based on their workflows. Organizations should assume shadow AI exists, make discovery a priority, and talk with employees to understand their needs rather than imposing blanket restrictions that drive confidential data sharing further into the shadows.