##### Press release # New Research from UpGuard Reveals 68% of Security Leaders Admit to Unauthorized AI Usage ##### [UpGuard Team](#) November 10, 2025 **Mountain View, CA - November 10, 2025** - [UpGuard](https://www.upguard.com/), a leader in cybersecurity and risk management, today released its new “[State of Shadow AI](https://www.upguard.com/resources/the-state-of-shadow-ai)” report. The report details the widespread use of unapproved generative AI tools, or “Shadow AI,” by employees in the workplace. Data shows that employees worldwide are actively bypassing corporate governance at all levels, with a staggering 8 out of 10 employees using unauthorized AI tools. This widespread non-compliance extends all the way to the top—68% of security leaders, including CISOs, admit to incorporating unauthorized AI into their daily workflows. This is of increasing concern for organizations as employees expose their companies to greater security risks. The report also highlights a critical AI security paradox. Despite 40% of employees reporting that they received AI safety training and have a better understanding of the risks, they are also the ones who use unapproved tools most frequently. This correlation suggests that compliance and security awareness campaigns need to evolve to accommodate employees' increasing drive for productivity and confidence in new technology. “Shadow AI has triggered a challenge in maintaining trust between employer and employee,” said Greg Pollock, head of Research and Insights at UpGuard. “Our data shows that increased security training and literacy does not curtail increased shadow AI usage; in fact, it increases it. Organizations need to better engage with their employees about AI to channel that curiosity appropriately.” ## Who is bypassing controls and at what level?  UpGuard’s research indicates that traditional security awareness methods are not effective against curtailing unapproved AI usage, and instead, are enabling “AI power users.” The paradox is further aggravated by seniority, with Shadow AI usage increasing alongside managerial authority; senior leadership across the organization is 50% more likely to use shadow AI. The report finds that: * A surprising 90% of security leaders themselves report using unapproved AI tools at work, with 69% of CISOs incorporating them into their daily workflows. * 27% of workers trust AI more than their managers or colleagues for reliable information, further highlighting the growing divide of non-compliance between employees and corporate authority. * 23% of CISOs know that passwords and other credentials are being shared with AI tools within their company, indicating that organizations are becoming increasingly exposed by the minute. * Furthermore, while 52% of employees are familiar with their company’s AI usage policy, 70% know of sensitive data shared with AI tools at their workplace ## Guiding enablement into the future Unauthorized AI usage in the workplace will continue to rise unless reinforced governance is implemented. It is clear that the problem cannot be solved by blocking applications, as 41% of employees find a way around it.  For companies keen on creating a transparent environment, a strategic necessity is a shift from a fear-based approach of restriction to one of guided enablement. This new pivot must address the next steps: providing visibility, implementing intelligent guardrails, and offering vetted tools to make the secure path the path of least resistance. Read the full report, including additional stats and insights on Shadow AI prevalence in the workplace at   #### Methodology * Data for this report were sourced from two separate methods. The survey of security leaders was conducted by Dynata between August 18-31, 2025. The 542 respondents were security professionals in leadership positions at companies with more than 200 employees located in the US, Canada, the APAC region (comprising Australia, New Zealand, Singapore, and Malaysia), and India. * The survey of employees was conducted using the Prolific platform between July 30 - August 11, 2025. The respondents were comprised of 1020 people in the US and UK who reported being currently employed and could provide the employee count and industry classification of their employer.  #### About UpGuard Founded in 2012, [UpGuard](https://www.upguard.com/) is a leader in cybersecurity and risk management. The company's AI-powered platform for cyber risk posture management (CRPM), provides a centralized, actionable view of cyber risk across an organization's vendors, attack surface, and workforce. Trusted by thousands of companies, UpGuard's platform is designed to help security teams manage cyber risk with confidence and efficiency. To learn more, visit www\.upguard.com. ‍ \### #### **MEDIA CONTACT** Tony Gruebner tony.gruebner\@upguard.com ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## UpGuard blog Learn about the latest issues in cybersecurity. #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 18, 2026 #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 11, 2026 #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 11, 2026 [View all blog posts](/blog) ## See UpGuard In Action Book a free, personalized onboarding call with one of our cybersecurity experts. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)