Enterprise Field Notes · Issue #1
Your Employees Are Already Using AI You've Never Approved
78% of employees use AI tools IT never sanctioned. Here’s what that number actually means, and why blocking it makes everything worse.
New here? Subscribe to Enterprise Field Notes, one new issue every week.
Here’s a number that stopped me cold when I first saw it: 78%.
That’s the percentage of employees currently using AI tools that their IT department never approved. Not a rogue few. Not a handful of early adopters. Nearly four out of five people on your team. Right now. (Salesforce State of IT, 2025)
Think about what that means in practice. Someone in your finance department is pasting budget projections into ChatGPT to get a summary. A sales rep is feeding deal notes, with client names, contract values, and competitive intel, into a free AI assistant to draft a follow-up email. A developer is running proprietary API logic through a browser-based tool to debug faster. They’re not doing it to cause problems. They’re doing it because it works.
This is Shadow AI. And if you’re an enterprise technology leader, it is almost certainly happening inside your organization right now.
We’ve Seen This Before
I spent over four years as Global Director of Site Reliability Engineering at a Fortune 500 global retailer. Before that, a decade-plus leading technology platforms across some of the largest organizations in the world. In that time, I watched this exact pattern play out three times over: first with cloud storage, then with SaaS apps, and now with AI.
The script is always the same: a powerful new tool emerges, employees discover it solves a real problem, IT and security can’t move fast enough to evaluate and deploy it safely, employees route around the bottleneck. The organization wakes up one day to find the new tool is already everywhere, except it’s outside every policy, compliance boundary, and security control they thought they had.
With Dropbox and Google Drive, the stakes were high. With unauthorized SaaS apps, they were higher. With AI, where employees are feeding the most sensitive data in your organization into third-party models, the stakes are categorically different.
The $670,000 Problem
$670K average increase in data breach cost when Shadow IT is involved
Source: IBM Cost of a Data Breach Report, 2024
That’s not the total breach cost. That’s the premium you pay because your data was somewhere you didn’t know about, running through systems you didn’t control.
When an employee pastes customer records into an AI tool to generate a report, that data doesn’t just disappear after the prompt resolves. Depending on the tool, the terms of service, the session caching behavior, and the training data policies of the provider, that data may persist, may be logged, may be used to improve a model, or may simply be sitting in a server you’ve never heard of in a jurisdiction you’ve never considered.
Your CISO didn’t sign off on that. Your legal team hasn’t reviewed those terms. Your compliance framework never accounted for it. And yet it’s happening today, in your organization, because you haven’t made a better alternative accessible.
The Real Problem Isn’t the Employees
Here’s what I see leadership get wrong when they first encounter Shadow AI data: they respond with restriction.
New policies. Blocked URLs. Stern all-hands talks about acceptable use. And for a few weeks, it slows down. Then the numbers quietly climb again, because the underlying pressure, the genuine productivity gap that AI solves, hasn’t changed.
The employees using unauthorized AI tools aren’t bad actors. They’re people trying to do their jobs in a world where AI makes them materially better at it. They’ve discovered a competitive advantage and they’re using it. The failure isn’t theirs.
The failure is that enterprise AI infrastructure hasn’t kept pace. The average enterprise AI deployment takes between six months and two years from decision to company-wide rollout. By which point, the team has already trained itself on three tools that IT doesn’t know about, and the approved solution feels like a step backward.
What ‘Controlled’ AI Actually Looks Like
The question isn’t whether your employees use AI. That ship has sailed. The question is whether they use AI that you control. And I mean that in the fullest sense. Not just ‘approved by IT’ with a checkbox. Real control:
· Your models. The ability to choose which AI models run which tasks, not vendor lock-in to whatever the platform decided was best. Different workloads need different intelligence. A summarization task shouldn’t cost what a code generation task costs.
· Your data. Zero retention by default. Your data does not train anyone else’s models. What happens in your AI environment stays in your AI environment.
· Your rules. Role-based access. Compliance controls your legal team actually understands. Audit logs. Policies that are enforced at the infrastructure level, not just in an acceptable use document nobody reads.
This is what enterprise AI governance actually requires. Not a policy. Not a ban. A platform that makes the safe option also the easy option, so employees don’t have to choose between being productive and being compliant.
The Deployment Gap
5% of AI projects make it from pilot to full production deployment
Source: Gartner AI Deployment Survey, 2024
Organizations are running AI pilots everywhere. Innovation labs, POCs, departmental experiments. And 95% of them never ship. They die in internal reviews, security evaluations, compliance cycles, technical debt, budget fights, and organizational entropy.
The result is a paradox: the organizations most actively working on ‘enterprise AI strategy’ are often the ones with the most Shadow AI risk, because the official strategy takes so long to deliver that employees route around it faster than it can catch up. Speed is not optional.
Why I’m Writing This
I co-founded Swa-AI because I watched this problem compound across organizations at scale. And because I knew, from having built infrastructure at this level, that the technical barrier to solving it is lower than most enterprises believe.
You don’t need a 12-month implementation. You don’t need a team of engineers. You don’t need to sacrifice productivity for compliance or compliance for productivity.
The architecture exists. The tools exist. The hard part isn’t the technology. It’s convincing organizations to stop treating AI governance as a security problem to be restricted, and start treating it as an infrastructure problem to be solved. That shift in framing changes everything.
Shadow AI isn’t evidence that employees are reckless. It’s evidence that demand far outpaced supply. And the solution isn’t to suppress the demand. It’s to build supply that’s worthy of it.
What Comes Next
Over the coming weeks, I’m going to break down every layer of this: why most AI pilots die before they ever reach users, what enterprise data sovereignty actually requires, the real cost model of per-seat AI pricing, and how to build governance for the agentic AI wave that’s arriving regardless of whether your organization is ready.
If you’re a technology leader trying to get ahead of Shadow AI, or trying to get your organization’s AI deployment out of perpetual pilot, follow here on Medium or connect on LinkedIn. Because AI should be yours. Your models. Your data. Your rules.
ABOUT THE AUTHOR: Ben Pickett is COO of Swa-AI and former Global Director of Site Reliability Engineering at Nike. Swa-AI delivers enterprise AI through Slack, Teams, and WhatsApp. Zero data retention, your choice of models, flat-rate pricing for full-workforce coverage. swa-ai.com
By Ben Pickett on .
Exported from Medium on July 21, 2026.
About the author
I'm Ben. I write Enterprise Field Notes, and by day I'm COO at Swa, after years running reliability, data protection, and database operations at Nike. The lesson that keeps proving itself: anything you cannot run without, and cannot walk away from, is a risk you have not priced yet. What is yours?
Read more of Ben's Enterprise Field Notes at benpickett.com.
© 2026 Ben Pickett · Enterprise Field Notes