Skip to main content
Workclone
ResearchShadow IT doubles
Research

Approved AI tools have failed to eliminate shadow IT; instead, they’ve doubled it, as 59% of businesses now manage twice as many unsanctioned platforms alongside their enterprise deployments

Rolling out a sanctioned AI tool has not contained shadow IT. Employees run multiple platforms at once, and sensitive data moves through personal tools with no material difference in handling.

WorkClone Research

Key findings

  • 59% of Australian businesses that deployed an approved AI tool report staff simultaneously using unsanctioned tools
  • Only 18% of employees use the approved tool exclusively
  • Employees with an approved tool use an average of 2.05 AI platforms, compared to 1.1 for those without company approval
  • 52% of employees with approved tools use personal tools at the same time
  • 30% of all AI users enter customer or client data into tools regardless of whether they are approved or personal
  • 14% of AI users input personally identifiable information into AI tools
  • 25% of employees are unaware that AI tools store inputs and may use them for model training
  • 55% of executives admit to inputting sensitive data into AI tools, the highest rate of any employee cohort
  • 20% of executives do not know consumer AI tools store and train on their inputs despite having broad access to sensitive organisational data
  • 80% of executives identify sensitive data input as a material risk, yet continue the behaviour

Why this matters

Traditional IT governance frameworks built on the assumption of employee compliance have become obsolete in the AI era. Shadow IT is no longer a containment problem; it is an active data exfiltration risk, with sensitive information flowing through multiple unsanctioned channels with no material difference in handling practices between approved and personal tools.

The paradox of executive risk awareness paired with executive non-compliance represents a critical governance gap that detection and monitoring alone cannot solve; organisations require frameworks that assume multi-platform usage and design controls around it rather than against it.