AI is already being used across your organization, whether it has been formally approved or not. Employees are adopting AI tools with or without IT involvement, fueling the rise of "shadow AI" across enterprises and creating gaps in governance, security, and cost control that most organizations are not equipped to manage.
This is no longer just an IT challenge. For Chief Information Security Officers, this shift is expanding the attack surface across devices, endpoints, and data flows, introducing unmanaged risk and increasing the likelihood of sensitive company data being exposed without proper controls. For CFOs, it means duplicated spend, fragmented budgets, and delayed ROI as AI initiatives proliferate across teams without visibility or coordination.
According to Lenovo's latest Work Reborn Report (surveying 6,000 employees worldwide), more than 70% of employees are using AI weekly, with up to one third operating beyond IT oversight. At the same time, 80% expect to increase their reliance on AI within the next year. This reveals a growing AI execution gap: usage is accelerating, but control is not keeping pace.
The Data: Shadow AI Is Already Affecting Business Performance
When AI usage scales without visibility or governance, the impact is not theoretical—it is already affecting cost, security posture, and the ability to scale AI across the business.
The enterprise impact breaks down into four categories:
Delayed ROI from fragmented initiatives: AI tools are being adopted in silos across departments (marketing uses one tool, sales uses another, engineering uses a third), with no central coordination or visibility. This fragmentation prevents organizations from identifying what works, scaling successful use cases, and consolidating around a unified strategy. Instead of realizing productivity gains in Q2, organizations are still running pilots across 15 disconnected teams in Q4, each generating marginal value that never compounds into enterprise-wide ROI.
Duplicated spend on overlapping tools: Without centralized procurement or governance, multiple teams are purchasing the same capabilities independently. One company reported three separate Slack-integrated AI assistants being purchased by different departments at $25/user/month each, costing $75K annually for 1,000 users when a single enterprise contract could have delivered the same functionality for $30K. Multiply this across the organization—CRM AI, document AI, code AI, meeting AI—and duplicated spend quickly reaches six figures.
Increased attack surface from unsanctioned tools: 61% of IT leaders report a rise in cybersecurity threats linked to AI adoption, yet only 31% feel confident in their ability to manage those risks. Meanwhile, 43% of employees are worried about AI-driven data exposure or attacks. The problem is simple: consumer-grade AI tools (ChatGPT, Claude, Gemini free tiers) often lack enterprise-grade security controls like SOC 2 compliance, data residency guarantees, or multi-factor authentication. When employees paste customer data, source code, or financial projections into these tools, that data may be stored on external servers, used to train AI models, or exposed in a platform breach.
Lack of visibility makes it difficult to scale what works: Even when a team discovers an AI workflow that delivers 20% productivity gains, IT has no way to identify, validate, and roll it out across the organization. The result is a "two-speed workforce" where some employees operate within secure, optimized environments, while others rely on whatever tools they can access to stay productive. This creates inconsistency, duplicates effort, and makes enterprise-wide AI adoption nearly impossible to achieve.
Photo by Pixabay on Pexels
Why Shadow AI Is Expanding Faster Than Security Can Respond
The shadow AI problem is not driven by employee negligence—it is driven by organizational agility outpacing governance. Most enterprises lack formal AI usage policies, making it unclear which tools are approved, which require security review, and which are outright prohibited. In this vacuum, employees default to productivity: if they need to summarize 50 customer calls, they will use whatever AI tool is easiest to access, whether it has been vetted by IT or not.
The numbers reflect this dynamic:
- 70%+ of employees use AI weekly, with 1 in 3 operating beyond IT oversight
- 80% expect to increase AI reliance within the next year
- 61% of IT leaders report rising AI-linked cyber threats
- Only 31% feel confident managing those risks
- 43% of employees worry about AI-driven data exposure
This is the AI execution gap in action: usage is scaling exponentially, but governance, security, and infrastructure are not.
The Problem: AI Is Being Managed in Fragments
Most organizations are trying to manage AI across disconnected layers. Devices are deployed and managed one way. Infrastructure is managed another. Security is often layered on after the fact. That fragmentation is what creates the AI execution gap.
Adding more tools or policies does not solve the problem—it increases complexity, leaves gaps between endpoints and infrastructure, and makes it difficult to enforce consistent control across the environment. What organizations need is not more layers, but a unified control model that governs AI from the point of entry (the device) through to infrastructure and security monitoring.
What CFOs, CIOs, and CISOs Should Do Now
The solution is not to block AI—that will only push more usage into the shadows. The solution is to professionalize AI adoption with governance frameworks that balance innovation and control.
For CFOs (Cost & ROI Perspective):
Centralize AI procurement and visibility. Without a clear picture of which teams are using which tools, you cannot consolidate spend, negotiate enterprise contracts, or measure ROI. Establish a central AI budget owner (often the CIO or CTO), require all AI tool purchases to flow through IT procurement, and implement SaaS management platforms (like Zylo or Torii) to track usage and costs. Gartner forecasts that AI governance spending will reach $492 million in 2026 and surpass $1 billion by 2030—a 100% increase that reflects the urgency organizations attach to this risk.
For CIOs (Scaling & Execution Perspective):
Build an approved AI tool catalog and make it easier to use than the shadow alternatives. Employees are not using unapproved tools because they want to bypass IT—they are using them because they are fast, accessible, and solve an immediate problem. If you want to bring shadow AI under control, you need to offer approved alternatives that are just as easy to use. Create an internal AI tool catalog (e.g., Anthropic Claude for Teams, GitHub Copilot, Microsoft Copilot, Google Gemini for Workspace) with pre-approved access, built-in security, and clear use case guidance. Then communicate it broadly: "If you need AI for X, use this tool."
For CISOs (Security & Compliance Perspective):
Implement AI gateway controls and endpoint monitoring. AI gateways (like those from Palo Alto Networks, Zscaler, or Cloudflare) sit between employees and external AI services, enforcing data loss prevention (DLP) policies, logging all interactions, and blocking unapproved tools. These gateways can redact sensitive data (like SSNs, credit card numbers, or proprietary code) before it reaches external AI models, reducing the risk of data exposure. Combine this with endpoint monitoring to detect unsanctioned AI tool usage (e.g., browser extensions, unauthorized API keys) and enforce compliance through device-level policies.
The Bottom Line
Shadow AI is not a future risk—it is already affecting business performance today. Organizations that fail to establish governance now will face delayed ROI, duplicated spend, expanded attack surfaces, and a "two-speed workforce" that slows decision-making and prevents AI from scaling enterprise-wide.
The fix is not to block AI, but to professionalize it: centralize procurement, build an approved tool catalog, implement AI gateway controls, and create a unified governance model that connects devices, infrastructure, and security into a single operating framework.
"AI adoption is no longer the challenge. Execution is," said Rakshit Ghura, Vice President and General Manager of Digital Workplace Solutions at Lenovo. "Usage is growing faster than organizations can control or secure it. Without that control, AI introduces as much risk and cost as it does opportunity."
Organizations that close the AI execution gap now will move from fragmented experimentation to measurable outcomes faster, reduce wasted spend, limit risk, and create a clear path to scaling AI across the business.
Continue Reading
Sources
- Lenovo Work Reborn Report: Leading Your Workforce to Triumph with AI (April 27, 2026)
- Shadow AI Explained: Risks, Costs, and Enterprise Governance
- The Hidden Security Risks of Shadow AI in Enterprises
What's your experience with shadow AI? Connect with me on LinkedIn, Twitter/X, or via the contact form to share how your organization is managing uncontrolled AI adoption.
Photo by Pixabay on Pexels