[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Human Cyber Risk](/category/human-cyber-risk) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Uncovering the Shadow AI Paradox](/blog/uncovering-the-shadow-ai-paradox) Publish date July 2, 2026 {x} minute read # Uncovering the Shadow AI Paradox [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/the-state-of-shadow-ai) [Free trial](/demo) Written by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Reviewed by [Peter Brittliff](/team/peter-brittliff) Senior Product Marketing Manager Peter is helping UpGuard build the world's best threat monitoring tools. [Phil Ross](/team/phil-ross) Chief Information Security Officer Phil is a Forrester Zero Trust Strategist leveraging decades of experience in enterprise cybersecurity architectures. Table of contents Report The State of Shadow AI - Trends, Insights & Statistics Free resource ### The State of Shadow AI - Trends, Insights & Statistics [Download now](/resources/the-state-of-shadow-ai) Does the world really need another study of shadow AI? That was my first thought going into this project. Reading dozens of previous reports did not change that impression: there's a lot of shadow AI out there, and a lot of reports saying so. But the more I read, the more apparent it became that something important was missing. This endless supply was not meeting what was actually in demand. While existing research answered the question "is there shadow AI," there wasn't much on the more important question–why? The naive answer is that AI tools help workers accomplish their tasks, so of course they will use them. On the other hand, it's also useful for workers who want to maintain their employment to abide by company policies, so it's not quite that simple. We need a more nuanced articulation of the incentives for and against using unsanctioned AI tools if we want an actor theory that can be operationalized to reduce risk from shadow AI. To understand why people use shadow AI, we need to be willing to consider more broadly why people do anything at all. Yes, we want to get our work done, and we want to avoid punishment, but we are also social creatures, driven mostly by emotions and the need for belonging, working with imperfect information to optimize for our perceived in-group's benefit. We need to add a little more texture to "people do what is good for them" to explain actual human behavior. I won't recapitulate [the entire report here](https://www.upguard.com/resources/the-state-of-shadow-ai), but that is a useful frame for reading it, and in particular for digesting the most challenging findings. The people most likely to use shadow AI are those who, on paper, should be the least likely: the AI experts and executives who feel like they have the intellectual or institutional authority to exempt themselves from the rules. (If you recognize yourself in that description, um, you aren't alone.) Those findings are counter-intuitive if you view humans as meaty computers, and perfectly intelligible if you think about any of the people in your life. That is my [big takeaway from this work](https://www.prnewswire.com/news-releases/new-research-from-upguard-reveals-68-of-security-leaders-admit-to-unauthorized-ai-usage-302609807.html): those concerned about the risks of shadow AI should engage with others in their organization as people. Our report discusses worker motives that are measurable in the aggregate, but human diversity is vast and the incentives driving people around you may differ. The risks of unapproved software are real, but so are the benefits that might be driving your coworkers to accept those risks. From here on, let's just assume people are using AI tools, and instead start the conversation by asking why. > Asking "why" is where enablement begins. The UpGuard AI Security Center is built on the same premise; don't dam the flow of AI, guide it: build understanding with AI Insights, set rules people can use with the AI Policy Toolkit, and vet the tools entering the workflow with AI Risk Check (coming soon).\ > \ > [Explore the AI Security Center →](https://www.upguard.com/solutions/ai-security) Report The State of Shadow AI - Trends, Insights & Statistics Free resource ### The State of Shadow AI - Trends, Insights & Statistics [Download now](/resources/the-state-of-shadow-ai) ## Related posts Learn more about the latest issues in cybersecurity. Human Cyber Risk #### [Best Shadow AI Governance Tools for Enterprises: Buyer's Shortlist](/blog/best-shadow-ai-tools) Compare top shadow AI governance tools for enterprises, covering key capabilities and how to shortlist the right platform for your organization. [](/team/shane-moosa) [Shane Moosa](#) September 7, 2026 Human Cyber Risk #### [Human Risk Management Platforms: How to Choose the Right Software](/blog/best-human-risk-management-platforms) Protect your workforce with human risk management software that fits. Compare 10 platforms, the features that matter, and how to choose the right one. [](/team/shane-moosa) [Shane Moosa](#) August 31, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) September 21, 2026 Human Cyber Risk #### [How to Mitigate Human Risk in Cybersecurity: A Practical Framework](/blog/how-to-mitigate-human-risk) Security awareness training alone isn't human risk management. Use this seven-step framework to discover, govern, and coach workforce behavior. [](/team/shane-moosa) [Shane Moosa](#) August 25, 2026 Human Cyber Risk #### [Best AI Governance Platforms and Software (2026 Comparison)](/blog/best-ai-governance-platforms) Compare the top AI governance platforms of 2026 and find the right fit for your workforce and compliance needs. [](/team/shane-moosa) [Shane Moosa](#) August 10, 2026 Human Cyber Risk #### [The Architecture of an AI-Powered Breach: The Shadow Supply Chain](/blog/ai-powered-breach-and-the-shadow-supply-chain) Decode three real-world AI breaches. Learn how Shadow AI pipelines bypass security and how real-time browser guidance can stop data leaks. [](/team/shane-moosa) [Shane Moosa](#) July 6, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)