Most shadow AI statistics start from a real measurement and then change a little each time another page repeats them. A survey of people who already use generative AI becomes a statement about all workers, a per-breach cost becomes an annual loss, and a survey of security professionals becomes a statement about employees. We traced the most widely repeated figures back to the report, press release or paper that first published them, and recorded the population, the method and the date behind each one. This page lists what holds up, what changed on the way, and what we could not trace. It was last verified on 1 October 2026.
The figures that hold up
The following figures were read in the primary document or in the publisher's own release. Each one is stated with the scope the source gives it, because the scope is usually the part that gets lost.
- 39.7% of all AI interactions involve sensitive data, counting prompt text, copy and paste actions and file uploads (Cyberhaven, February 2026).
- 34.8% of the corporate data employees put into AI tools was sensitive, up from 27.4% a year earlier and 10.7% two years earlier, across 7 million workers (Cyberhaven, April 2025).
- 2.6% of 22,458,240 enterprise generative AI prompts collected during 2025 contained sensitive data, which is 579,113 instances (Harmonic Security, January 2026).
- One in five organisations reported a breach due to shadow AI, and organisations with high levels of shadow AI paid an average of $670,000 more per breach (IBM Cost of a Data Breach 2025, based on 600 organisations).
- 75% of knowledge workers use generative AI at work, and 78% of those who use AI bring their own tools (Microsoft and LinkedIn Work Trend Index 2024, 31,000 respondents in 31 countries).
- Over half of generative AI users said they use it without formal employer approval, and these users were 28% of the workers surveyed (Salesforce, November 2023, more than 14,000 employees in 14 countries).
- 77% of users paste data into generative AI tools and 82% of that activity comes from unmanaged accounts (LayerX Enterprise AI and SaaS Data Security Report 2025, browser telemetry from enterprise customers).
- 48% of respondents said they had entered non-public company information into generative AI, among 2,600 security and privacy professionals in 12 countries (Cisco 2024 Data Privacy Benchmark Study, survey fielded in summer 2023).
- $4.99 million is the global average cost of a data breach in IBM's 2026 edition, and $6 million for breaches in which attackers used AI (602 organisations, March 2025 to February 2026).
How the figures were checked
For every figure we located the original publication, read the sentence that contains the number, and recorded who was counted, how they were counted and when. Where the original page could no longer be read at its current address, we used an archived copy and say so. Where a publisher blocked automated access and we could read the figure only as quoted by a trade publication, the figure is marked as such in the tables. A figure we could not locate in any primary document is listed separately in Table 3 instead of being dropped, because the absence of a source is itself useful information for anyone about to cite it.
What the most cited measurements actually measured
Table 1: Source, population and method behind the most repeated shadow AI figures
| Source | Type of number | Population | Period | Headline figure |
|---|---|---|---|---|
| Microsoft and LinkedIn, Work Trend Index | Survey | 31,000 knowledge workers, 31 countries (fielded by Edelman Data & Intelligence) | 15 February to 28 March 2024 | 75% use generative AI at work; 78% of AI users bring their own tools |
| Salesforce, Generative AI Snapshot | Survey | More than 14,000 full-time employees, 14 countries (YouGov) | 18 to 31 October 2023 | Over half of generative AI users use it without employer approval |
| Cisco, 2024 Data Privacy Benchmark Study | Self-reported survey | 2,600 security and privacy professionals, 12 countries | Summer 2023 | 48% entered non-public company information |
| IBM and Ponemon Institute, Cost of a Data Breach 2025 | Analysis of breaches | 600 organisations that experienced a breach | March 2024 to February 2025 | One in five reported a breach due to shadow AI; $670,000 higher breach cost at high shadow AI levels |
| Cyberhaven, 2025 AI Adoption and Risk Report | Product telemetry | 7 million workers at Cyberhaven customers | Previous 24 months, published April 2025 | 34.8% of data put into AI tools was sensitive |
| Cyberhaven, 2026 AI Adoption and Risk Report | Product telemetry | Sample size not stated on the published page | Published February 2026 | 39.7% of AI interactions involve sensitive data |
| Harmonic Security, 2025 report | Browser telemetry | 22,458,240 prompts from US and UK organisations (number of organisations not disclosed) | 1 January to 31 December 2025 | 2.6% of prompts contained sensitive data |
| LayerX, Enterprise AI and SaaS Data Security Report | Browser telemetry | LayerX enterprise customers | Report published 2025 | 77% of users paste data into generative AI; 82% of that from unmanaged accounts |
| Mireshghallah et al., Trust No Bot (COLM 2024) | Academic analysis | 5,000 sampled English conversations from WildChat, a public dataset of free GPT-3.5 and GPT-4 use | Paper published July 2024 | PII in 48% of translation and 16% of code-editing conversations |
Self-reported, observed and forecast numbers are different things
The nine sources in Table 1 answer three different questions. Surveys such as the Work Trend Index, the Salesforce Snapshot and the Cisco study measure what people say they do, and respondents may under-report or over-report. Telemetry from Cyberhaven, Harmonic and LayerX measures what a monitoring product observed, but only at organisations that have deployed that product, and all three vendors sell data loss prevention tools, so their customer base is not a random sample of employers. The IBM figures come from organisations that had already suffered a breach, which says nothing about organisations that did not.
A fourth category is often quoted alongside the first three and should not be. Gartner's survey of cybersecurity leaders found that 69% suspect or have evidence that employees use prohibited public generative AI, which is a measure of what security leaders perceive, and Gartner's statement that more than 40% of organisations will suffer security and compliance incidents from unauthorised AI by 2030 is a forecast (both as reported by Infosecurity Magazine). Neither describes a rate that has been observed.
Why 2.6% and 39.7% can both be correct
Harmonic reports that 2.6% of enterprise prompts contained sensitive data, while Cyberhaven reports that 39.7% of AI interactions involve sensitive data. The gap is a factor of roughly fifteen, and it appears between two credible vendors looking at workplace AI use in the same period. Harmonic counts prompts in which its detection found a sensitive instance. Cyberhaven counts interactions, a term that includes copy and paste actions and file uploads as well as typed prompts. A single uploaded document can hold many sensitive items, so the two numerators are not the same kind of event, and the populations also differ. The published material does not allow us to say how much of the gap comes from definitions and how much from the organisations measured.
What can be said is narrower and more useful. Cyberhaven applied one metric, the share of corporate data put into AI tools that is sensitive, over three consecutive years, and the series rose from 10.7% to 27.4% to 34.8%. A trend inside a single method is more trustworthy than a comparison across methods, and it points in a consistent direction.
How a figure changes when it is repeated
The comparison below sets the wording in which several figures commonly circulate against what the original source says. We have left the names of the pages that repeat them out on purpose. The pattern is the point, and it appears repeatedly on the roundup pages we read.
Table 2: Figures as commonly repeated and as originally published
| As commonly repeated | What the source says | What changed |
|---|---|---|
| 55% of workers use unapproved AI tools | Over half of generative AI users, who were 28% of the workers surveyed, used it without formal employer approval (Salesforce, November 2023) | The denominator moved from AI users to all workers |
| 75% of workers use unsanctioned AI tools | 75% of knowledge workers use generative AI at work, and 78% of AI users bring their own tools (Microsoft and LinkedIn, 2024) | Use of AI in general became unsanctioned use |
| 52% would not tell their manager they use AI | 52% of AI users are reluctant to admit using AI for their most important tasks (Microsoft and LinkedIn, 2024) | The claim was broadened from important tasks to all use, and from reluctance to refusal |
| 20% of data breaches involved shadow AI | One in five organisations reported a breach due to shadow AI (IBM, 2025) | Organisations became breaches |
| $670,000 annual loss from ungoverned AI | Organisations with high levels of shadow AI paid an average of $670,000 more per breach (IBM, 2025) | A per-breach premium became an annual loss |
| 63% of organisations have no AI governance policy | 63% of breached organisations either have no AI governance policy or are still developing one (IBM, 2025) | The population narrowed to breached organisations and the second half of the clause disappeared |
| 48% of employees entered confidential company data into AI | 48% of 2,600 security and privacy professionals said they had entered non-public company information (Cisco, 2024) | Respondents changed from security and privacy professionals to employees; some roundups also name a different Cisco report |
| 68% use public AI through personal accounts (Menlo Security) | According to SiliconANGLE, a TELUS Digital survey cited in Menlo's report, and not Menlo's own telemetry | The attribution moved from the cited survey to the citing report |
| Average breach cost is $4.88 million or $4.44 million | $4.99 million in the 2026 edition of the IBM report; $4.44 million was the 2025 edition and $4.88 million the 2024 edition | Older editions are still repeated on pages dated 2026 |
| 4.2% of workers have pasted company data into ChatGPT | The updated Cyberhaven article of June 2023 reads 4.7% of employees, at Cyberhaven customer companies, had pasted sensitive data at least once | The figure was revised after the URL and the first press coverage carried 4.2% |
| 11% of what employees paste into ChatGPT is confidential | Sensitive data made up 11% of what employees pasted, measured from 26 February to 9 April 2023 across 1.6 million workers (Cyberhaven) | A measurement of one tool at one vendor's customers in early 2023 is presented as a current general rate |
| Employees who use generative AI paste company data 77% of the time | 77% of users paste data into generative AI tools (LayerX). The report says both "users" and "employees", and it also states that 45% of enterprise users actively use AI platforms, so the denominator is most plausibly those who use AI | The denominator is not stated by the source, and repetitions usually assume all employees |
What Trust No Bot does and does not show
The paper by Mireshghallah, Antoniak, More, Choi and Farnadi is frequently cited for the finding that PII appears in 48% of translation requests and 16% of code-editing requests sent to GPT models. The finding is accurate, but the data behind it are consumer conversations. WildChat was built by giving members of the public free access to GPT-3.5 and GPT-4 in exchange for agreeing to share their conversations, the authors kept English-language conversations only, and the PII labels come from an automated detector. Most of what it detected were names of people and organisations. The study therefore tells us how members of the public behave with a free chatbot, and it does not measure what employees put into work prompts.
The paper contains a second finding that matters for anyone designing a safeguard. WildChat's curators had already removed PII once using Microsoft Presidio, a rule-based tool, and the authors still found some form of detected PII in over 70% of queries. They note that rule-based removal often misses PII that is not well formatted. A single pass with pattern matching does not catch names in free text, which is why detection approaches based on trained language models are used for this task. The redaction guide lists eight points for evaluating a redaction tool, including how it handles names in free text.
Figures we searched for and could not trace
The figures in Table 3 appear on roundup pages, usually without a link. We searched for a primary document containing each one. A failed search does not prove that a figure does not exist, but until a source is found the figures should not be cited as established.
Table 3: Figures without a primary source we could locate
| Figure as circulated | Attributed to | What we found |
|---|---|---|
| 158 or more shadow AI tools per enterprise | Gartner | No primary document located. The Gartner shadow AI release quoted by Infosecurity Magazine reports the 69% and 2030 figures discussed above, not this one |
| Shadow AI will cost enterprises $40 billion by 2027 | Gartner | No primary document located |
| Three times growth in unapproved AI tools since 2022 | Forrester | No primary document located |
| 43% experienced intellectual property leakage through shadow AI | Bitglass or Forcepoint | No primary document located |
| 55% created data sovereignty violations | DLA Piper | No primary document located |
| 41% of executives used unsanctioned AI | Deloitte | No primary document located |
| 38% of shadow AI inputs contain sensitive data | Nightfall | No primary document located |
| 65% of employees use unapproved AI tools | Salesforce State of IT 2024 | Not found in the Salesforce research we read; the 55% figure in Table 2 is the Salesforce number we could confirm |
| More than 300,000 ChatGPT credentials exposed | Group-IB | The figures Group-IB published are 101,134 devices with saved ChatGPT credentials between June 2022 and May 2023, and more than 225,000 logs between January and October 2023, as reported by SC Media |
Five questions to ask before citing a shadow AI statistic
- Who was counted, and is the percentage taken over all employees, over people who use AI, or over organisations?
- Was the behaviour observed by a tool or reported by the respondent in a survey?
- Whose customers or respondents make up the sample, and does the publisher sell a product that benefits from a high number?
- When was it measured, as opposed to when the page was published or last updated?
- Is it a measurement, a perception or a forecast?
The same five questions apply to the figures in this article. The sources are linked in the structured data of this page and in the tables, and we update the page when a source changes or a figure in Table 3 is traced.
Where redaction fits
The measurements disagree about rates, but they agree about the mechanism: text and files are pasted or uploaded into a prompt, frequently from accounts the employer does not manage, and the content often includes personal data. Redactic addresses that step by detecting personal data in documents and replacing it with placeholders before the text reaches a model, so that the model works on the document without the identities in it. The redaction guide explains the two modes and the five-step workflow, and the article on shadow AI in HR applies it to recruiting and performance data. The same problem is treated for law firms and litigation documents and for accounting practices handling payroll and tax identifiers.
Frequently asked questions
What is the most reliable shadow AI statistic?
No single figure answers every question, but the most robust evidence is a series measured with one method over time. Cyberhaven's share of sensitive data in corporate AI input, which rose from 10.7% to 27.4% to 34.8% across three years, is the clearest example. For the size of the sample, Harmonic's 22,458,240 prompts from 2025 is the largest we found.
Do the statistics show how many employees paste confidential data into AI tools?
Not directly. LayerX reports that 77% of users paste data, Cyberhaven's 2023 analysis found 4.7% of employees at its customers had pasted sensitive data, and Cisco's survey found 48% of security and privacy professionals saying they had entered non-public information. The numbers differ widely because the populations, the definitions of sensitive data and the methods differ, so they cannot be combined into one rate.
Is Trust No Bot evidence about AI use at work?
It is evidence about members of the public using a free chatbot. The conversations come from WildChat, are in English and were labelled by automated detection, so the 48% and 16% figures describe consumer behaviour and should not be presented as rates for employees.
How current are these figures?
The page was last verified on 1 October 2026. The underlying measurements range from early 2023 (Cyberhaven's 11% and the Salesforce survey) to full-year 2025 (Harmonic) and February 2026 (Cyberhaven), so each figure should be cited with the period it covers and not with the year of the page that repeats it.
Related guides
- Data Redaction Guide 2026: How to Mask PII for GDPR and AI Compliance
- Shadow AI in HR: How to Use AI Tools Without GDPR Violations (2026)
- Contract Redaction Guide: Litigation, Witnesses, Sensitive Clauses (2026)
- Document Redaction for Accountants: Payroll, Tax IDs, GDPR Workflow (2026)
See how Redactic puts this into practice: Redactic document redaction · Trust pages and DPA.