Shadow AI is one of the fastest-growing and most-overlooked issues in enterprise AI strategy. Three in four workers report using AI tools their company didn't approve. Most organizations respond by tightening controls and trying to restrict access. That response isn't wrong. Shadow AI carries real risk, and it's reasonable to want guardrails around it.
But restriction alone is an incomplete answer. Shadow AI is a security problem but also a signal. And most organizations are so focused on suppressing it that they never stop to ask what it's actually pointing to.
Why shadow AI happens
Workers may reach for unofficial tools for several reasons, and each one points to a different root cause.
The most common driver is friction. When the official stack is fragmented and hard to navigate, workers stop using it. Our data backs this up. In high-friction environments, 89% of technical workers report turning to AI tools their company didn't approve. When asked why, the answers are practical: 57% say unofficial tools are easier to use, and 49% say they work better with other tools. When your approved stack adds overhead instead of removing it, the path of least resistance runs straight to whatever works.
Enablement gaps are a second driver. Workers who don't know what's available in their official stack will go find something on their own. This is a natural response to being under-equipped. If nobody has shown them what to use or when to use it, they'll figure it out themselves with tools that they're more familiar with.
Sometimes the reason is simpler: Unofficial tools genuinely have capabilities the official stack doesn't. Fifty-nine percent of shadow AI users say unofficial tools have better features. That's a signal worth taking seriously, not as a reason to abandon your stack but as an honest input into whether it's meeting your teams' needs.
Finally, there's experimentation and curiosity—especially in engineering, product, and design (EPD), where engineers and product managers actively want to try new capabilities as they emerge. The approved stack can't always keep pace with how fast the market moves, and 27% of technical workers say their organization doesn't give them enough time to learn and explore new tools. When curiosity has nowhere to go inside the official stack, it goes outside it.
Underneath several of these drivers runs a common thread: speed. Workers under pressure reach for whatever gets the job done fastest, and that's usually the tool they already know. In high-friction environments, 96% of technical workers say they'd rather use a familiar tool even when they know a better one exists. Urgency and familiarity bias reinforce each other, and both push workers away from the approved stack.
The risks of shadow AI
For EPD teams specifically, the stakes are higher than they might appear. When engineers use unofficial AI tools to write or review code, proprietary architecture and business logic leaves your sanctioned systems. When PMs use unofficial tools to draft specs or analyze customer data, it puts sensitive product strategy and customer information at risk. Most unofficial tools haven't been vetted against your IT team's security standards, and data that enters them may not stay within your walls.
Beyond security, there's a compounding operational risk. EPD work is deeply interconnected. Decisions made in one place ripple across roadmaps, requirements, and delivery plans. When that work happens in tools nobody else can see or audit, institutional knowledge becomes fragmented, outputs become inconsistent, and leaders lose visibility into how AI is actually shaping the product being built.
Why restricting it isn't enough
Tightening controls is a reasonable first response. But restriction addresses the symptom, not the cause. The friction and enablement gaps that drove workers to unofficial tools don't disappear when you block access; they just become harder to see.
The more useful response is to treat shadow AI as a diagnostic. High rates in a particular team or function are telling you something specific: The official stack isn't working the way those people work. That's actionable information. It points to where friction is highest, where enablement has fallen short, and where your official tools may have genuine capability gaps worth addressing.
Different drivers require different fixes. Friction calls for better integration and a more connected stack. Enablement gaps call for training and clearer guidance on what to use when. Genuine capability gaps call for an honest evaluation of whether your approved tools are actually meeting your teams' needs. The goal isn't zero shadow AI—some experimentation will always exist in EPD teams, and that's not a bad thing. The goal is understanding what the signal is telling you and responding to the right root cause.
What to do next
Shadow AI rates are one of the clearest signals your organization sends about the health of your AI environment. Before you respond to them, it's worth understanding what they're actually telling you: whether your teams are navigating too much friction, haven't been properly enabled, or are working around genuine gaps in your official stack.
The AI Value Quadrant Assessment maps your organization across both conditions and surfaces what to prioritize first so your response addresses the root cause, not just the symptom.
