Shadow AI use persists as most workers use tools their employer bans
Two-thirds of office workers used AI tools they believed were banned at work, per a PagerDuty survey. Source code, client files and HR records are landing in public models faster than security teams can see them. 67% now use AI, only 18% of firms have a policy.
The bigger security story inside most companies right now is not a hacker, it is the employees. A PagerDuty 2026 survey found that two-thirds of office professionals have used AI tools they believed their own employer prohibited, and nearly half said they would rather use those tools quietly than risk being told no. Separate Salesforce data puts overall AI use at 67% of workers, while only 18% of organizations report having a formal AI security policy. What makes this a data-governance problem rather than a productivity story is what actually gets typed in. Researchers point to source code, client proposals, HR records and financial documents being pasted into public models that no security team can monitor or recall. Every one of those prompts can become training data or an uncontrolled copy of confidential material sitting outside the company. The practical takeaway for anyone running IT or compliance: a written policy banning AI is not the same as control. Workers are adopting these tools faster than organizations can govern them, and the gap between the 67% who use AI and the 18% who have rules for it is where the next wave of data leaks and regulatory exposure will come from. Sanctioned, monitored tools tend to beat prohibition, because prohibition simply pushes usage into the shadows.