About

Verizon says shadow AI is exposing company IP through unsanctioned AI use

Published
Score
20

Why it matters

Verizon's 2026 Data Breach Investigations Report has quantified a significant security gap: 67% of professionals using AI tools at work do so through personal accounts that IT has not authorized, and 28% of data-loss-prevention violations now involve employees uploading source code into unapproved AI systems. The report defines "shadow AI" as the use of AI tools, assistants, models, browser extensions, or personal accounts without formal approval from IT, security, legal, or compliance teams. Exposed material includes source code, intellectual property, internal documents, and customer records.

The full scope of data loss tied to shadow AI remains unclear. Verizon has not disclosed which specific organizations or industries are most affected, nor has it published granular breakdowns of the types of intellectual property being exposed or the frequency of incidents per organization.

For in-house counsel and compliance officers, this report signals that AI governance has moved from policy planning to active breach risk. The data suggests that employees are adopting AI faster than corporate controls can manage, creating a direct channel for proprietary information to leave the organization through personal logins and public platforms. Organizations without explicit shadow AI policies and monitoring should treat this as a priority for IT, legal, and board-level discussion. The gap between approved tools and actual employee behavior is now a measured liability.

mail Subscribe to Privacy email updates

Primary sources. No fluff. Straight to your inbox.

Also on LawSnap