Shadow AI

Securing shadow AI: company data stays in the company

Employees use private AI accounts at work every day. What goes in can be stored for years, viewed by people and used for training, far outside the EU. Several layers of protection stop it.

How widespread it is

Shadow AI is everyday practice

Shadow AI means AI tools that the company has not provided, such as private chatbot accounts. Three current studies:

67 %

of users access AI services on company devices with accounts that are not the company's own. Shadow AI is now the third most common non-malicious insider action, four times more frequent than a year before (Verizon, 2026).

29.1 %

of employees in Germany who use AI at work use tools their employer did not provide. In companies with fewer than 50 employees it is 33.5 % (IW, 2026).

82 %

of employees in Spain who use AI have used tools the company did not provide, without telling it (Cegid, 2026).

The data most often handed to outside AI tools is source code, followed by images, structured data and technical documents (Verizon, 2026).

What happens to the data

The digital fingerprint: once outside, the data does not come back

Stored and used for training

On private accounts, conversations can flow into the training of future models: with ChatGPT as long as “Improve the model for everyone” is switched on; with Claude, for those who allow it, kept for up to five years.

Viewed by people, anywhere in the world

Training data is labelled by people. In 2026, Swedish newspapers reported that videos from Meta's AI glasses, including intimate scenes, were reviewed by data annotators in Nairobi, Kenya.

The trail leads back to the company

Names, client numbers, file names and wording form a digital fingerprint. A contract, a payslip or a client file in a private account can be traced back to the company it came from, and it cannot be called back.

How it is secured

Several layers of protection, each closing a gap of the others

No single control is enough. Ingenious Networks combines protection on the device, at the data, in the network and on phones.

On the device: Windows and Mac

Endpoint protection blocks unapproved AI services on Windows and macOS, in every browser. With Microsoft, Defender for Cloud Apps keeps the list of AI services and marks them as approved or blocked; Defender for Endpoint enforces it on each device.

At the data: data loss prevention

Data loss prevention checks what leaves the device. Microsoft Purview stops sensitive content, such as client data or contracts, from being pasted or uploaded into AI websites, while normal browsing stays possible.

In the network: the firewall

A modern firewall recognises AI services by their traffic patterns and blocks them, or only the upload of files and confidential keywords. It protects every device in the company network, including private phones in the company Wi-Fi.

On phones: mobile device management

Mobile device management keeps company data inside company apps. With Microsoft Intune, copying from Outlook or Teams into a private AI app is blocked, on iPhone and Android, also outside the office.

The approved alternative

Blocking alone pushes people to workarounds: shadow AI is a sign that the team wants AI. That is why the team gets an AI in the EU, with the AI gateway of Ingenious Networks: names are replaced by numbers before the AI sees a document.

How it is secured

Sources

Where the figures come from

Contact

Your AI. Your data. In the EU.

Discuss a use case with us

20 minutes, without obligation: the situation is described, and we say what AI can realistically do, and what it cannot.

Open the form

Email: contact@ingnetworks.com
Phone: +49 1515 3851511
Address: Ingenious Networks GmbH
Eisenacher Straße 6
10777 Berlin, Germany