NOTES
How to report shadow AI risk to the board when you cannot measure it
A shadow AI exposure number that no control in your environment can produce should go to the board as a known gap with a plan and a date, not as an estimate. Show what each control tier sees and cannot see: a network proxy sees domains but not prompts, a CASB sees the tenant you own but not personal accounts, an endpoint agent sees the browser session on managed devices (for some tools, the prompt before it is sent) and nothing off those devices, and none of them sees a prompt typed into a free account on a personal phone.
Why the number does not exist yet
Shadow AI is employee use of AI tools the organization has not approved. The board question is reasonable: how much of it is there, and what is in it. The answer most security leaders can give is a domain count from the proxy and a usage report from the sanctioned tenant. Neither is the number the board asked for.
The proxy log says how many sessions went to chat.openai.com. It does not say whether the user was on a personal account or the company one, and it does not say what was typed. The CASB report covers Copilot or Gemini inside the tenant the company pays for. It has no view of the same employee's free ChatGPT account, because that account is not in the tenant. Both reports are accurate and both measure something other than exposure.
This is a structural limit of where each control sits, not a configuration error. Reporting a domain count as an exposure number invites the follow-up question that ends the meeting: "and what was in those sessions?"
The board is asking now. The National Association of Corporate Directors' 2026 cyber-risk oversight toolkit defines shadow AI as "unauthorized use of AI tools, applications, or features by employees without the knowledge, approval, and oversight of the company" and gives directors the question to put to management: "What actions are we taking to prevent Shadow IT and unauthorized AI use? How are we measuring success?" (NACD, AI discussion guide, 16 April 2026).
The coverage table
Each row is a control tier. Read the third column before the second.
| Control tier | What it sees | What it cannot see | Cost to close the gap |
|---|---|---|---|
| Network proxy or secure web gateway | Destination domains and URL categories, session counts, timestamps, and the user if the device authenticates to the proxy. Can block or allow by category. | Prompt content (traffic is encrypted unless you run TLS inspection). Personal versus corporate account on the same domain. Anything from a device that is off the network or not routed through the proxy, including phones and home machines. | Configuration time if you already own a firewall or gateway with category logging: turning on an AI category is hours, not a purchase. Extending coverage to remote devices means a cloud gateway client on every managed device, sold per user; some vendors publish a free tier for small headcounts. TLS inspection is a project (a certificate on every managed device, exceptions for pinned apps), and its reach is limited to devices that trust that certificate, which is the same managed-device boundary as the endpoint row. |
| CASB on the sanctioned tenant | API-level activity inside the tenant you own: who used Copilot or Gemini, what files were shared, which DLP policies fired, which third-party apps were granted OAuth access to company accounts. In log-based discovery mode, the same domain-level signal as the proxy row (traffic to AI apps the tenant does not own, from the firewall or proxy logs you feed it). | Inside any account the tenant does not own: personal ChatGPT, Claude, Perplexity, or Gemini accounts, and free tiers generally. Discovery mode can show that traffic to those apps exists; it cannot show who is on a personal account or what was sent. | Often already licensed. Microsoft includes Cloud Apps Discovery in Microsoft 365 E3 and E5 (enterprise plan comparison, read August 2026) and sells the full product inside the Microsoft Defender Suite at $12 per user per month on top of E3 (Defender for Cloud Apps product page, read August 2026). The Business Premium comparison page does not list it. Setup is connecting the tenant, feeding it logs, and reviewing OAuth grants: days, not weeks. |
| Endpoint agent or browser extension | The browser session on managed devices: which AI app, whether the account is personal or corporate, and for some tools the prompt text before it is submitted, with the option to block or redact. | Anything off the managed estate: unmanaged machines, mobile browsers and apps, any device where the agent is missing or disabled, and the user who switches to a phone. | Per-user subscription. None of the eight vendors checked in August 2026 publishes a price (LayerX, Cyberhaven, Harmonic Security, Nightfall, Prompt Security, Reco, Nudge Security, Zenity); expect a quote. Deployment rides on your device management, so the real cost is the share of devices you already manage. |
The table is accurate for the general case. A specific product may extend a row, and you should ask the vendor to point at the row it extends and say what it still cannot see.
What this table does not tell you
The table describes what each control can observe on the devices and accounts it reaches. It does not tell you:
How much shadow AI use happens outside all three tiers. An employee with a free account on a personal phone is invisible to the proxy, the CASB, and the endpoint agent at the same time. No published telemetry measures this population directly. The nearest evidence is survey data: two-thirds of non-IT office professionals at organizations with $500M or more in revenue report using AI tools at work despite believing it was not permitted (PagerDuty, 11 June 2026, n=1,250), and 69% of organizations suspect or have evidence of prohibited public GenAI use (Gartner, 19 November 2025, n=302). Neither figure is your figure.
What was in the prompts you did see. Domain hits and session counts say nothing about content. Vendor telemetry from organizations that do inspect content puts sensitive data in a large minority of interactions (39.7% in one 222-company sample, Cyberhaven Labs, February 2026); that is a prior, not a measurement of your environment.
Whether closing all three gaps would produce the number. It would not. Full coverage of managed devices and owned tenants still leaves personal devices, and the residual is unmeasurable by design.
What it costs when it goes wrong. The published figures are averages: in the 2025 study, one in five organizations reported a breach due to shadow AI, and high levels of shadow AI added $670,000 to the mean breach cost (IBM newsroom, 30 July 2025; IBM, Cost of a Data Breach 2025). The 2026 edition reports roughly one in five organizations with a breach involving an attack on an AI model or application, which is a different measure (IBM, Cost of a Data Breach 2026). A figure circulating in trade coverage that 43% of breaches now involve shadow AI does not appear in the 2026 report itself.
How to report it
Report coverage, not exposure. The slide has four lines.
Coverage now. Which tiers you have, and what share of devices and accounts they reach. "Proxy on 100% of office traffic and 0% of remote; CASB on the M365 tenant; no endpoint agent. Managed devices: 310 of an estimated 340 in use."
The gap. What the tiers cannot see, in the board's terms. "We can count sessions to AI domains. We cannot see prompt content, personal accounts, or use from personal devices. We do not have an exposure number and no control we could buy would give us one for personal devices."
The plan and the date. One tier to add or extend, its cost from the table, and when it will be reporting. "Endpoint agent on managed devices by 31 October; quote in hand; covers the prompt on managed devices and identifies personal accounts. Personal-device use stays a policy and training control."
What changes the report. The trigger for coming back early. "Any confirmed regulated data in an AI session, or a vendor incident involving a tool our people use."
This is a known gap with a plan and a date. It resembles the finding-plus-remediation format audit committees already see, and it survives the follow-up question because it answers it in advance.
A worked example of the alternative: on 11 May 2026 a publicly traded bank holding company filed a Form 8-K under Item 1.05 after an employee used "an unauthorized artificial intelligence-based software application" to handle customer names, social security numbers, and dates of birth (Form 8-K, SEC EDGAR, filed 11 May 2026). The filing describes the incident, not the coverage that preceded it.
What the rules actually require
Nothing requires an organization to produce a shadow AI exposure number. Several rules require it to know what AI is in use, which is a different and achievable obligation.
The NIST Generative AI Profile tells organizations to "enumerate organizational GAI systems for incorporation into AI system inventory and adjust AI system inventory requirements to account for GAI risks" (action GV-1.6-001, NIST AI 600-1, July 2024), and to "inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists" (GV-6.1-007).
New York's financial regulator has told covered entities that asset inventories required under 23 NYCRR Part 500 apply to AI assets, and that risk assessments "must take into account cybersecurity risks faced by the Covered Entity, including deepfakes and other threats posed by AI" (NYDFS industry letter, 16 October 2024).
The FTC Safeguards Rule requires non-bank financial institutions to "identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes" as part of the risk assessment (16 CFR 314.4(c)(2)). CIS Controls v8.1 Safeguard 2.1 requires a software inventory reviewed at least twice a year (CIS Controls assessment specification).
State AI statutes in Colorado, Texas, California, and Illinois are scoped to systems that make or substantially influence consequential decisions such as hiring or lending. They do not reach ordinary employee use of a chat assistant, and a board report should not claim they do.
A shadow AI tool falls outside every inventory above until someone finds it. The coverage table is how you say how much of the finding you can do.
Definitions
Coverage table. A table listing each control tier an organization operates, what that tier can observe, what it structurally cannot observe, and the cost to extend it. It reports observability, not exposure, and is accurate whether or not any shadow AI is present.
Control tier. A category of security control defined by where it sits: on the network path, inside an owned cloud tenant, or on the device. Each tier has a fixed field of view that no product within the tier can exceed.
Known gap with a plan and a date. A board-reporting format in which an unmeasurable risk is stated as a named gap in coverage, with the control that would narrow it, its cost, and the date it will be reporting. It replaces an estimate the presenter cannot defend.
Shadow AI. Use of AI tools, applications, or features by employees without the knowledge, approval, and oversight of the organization.
Sources
- NACD, AI discussion guide, 2026 Cyber-Risk Oversight Handbook Toolkit, 16 April 2026. https://www.nacdonline.org/all-governance/governance-resources/governance-research/director-handbooks/2026-cyber-risk-oversight/cyber-risk-handbook-toolkit-2026/ai-discussion-guide/
- PagerDuty, shadow AI workplace survey, 11 June 2026, n=1,250 office professionals at organizations with $500M+ revenue, US, UK, Australia, Japan. https://www.pagerduty.com/newsroom/shadow-ai-workplace-survey-2026/
- Gartner, press release, 19 November 2025, n=302 cybersecurity leaders surveyed March to May 2025. https://www.gartner.com/en/newsroom/press-releases/2025-11-19-gartner-identifies-critical-genai-blind-spots-that-cios-must-urgently-address0
- Cyberhaven Labs, 2026 AI Adoption and Risk Report, February 2026, telemetry from 222 companies. https://www.cyberhaven.com/resources/report/ai-adoption-risk-report-2026
- IBM newsroom, Cost of a Data Breach Report 2025 press release, 30 July 2025. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- IBM, Cost of a Data Breach Report 2025, 30 July 2025. https://www.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai
- Microsoft Defender for Cloud Apps product page, read August 2026. https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-cloud-apps
- IBM, Cost of a Data Breach Report 2026, 29 July 2026. https://www.ibm.com/think/x-force/2026-cost-of-a-data-breach-ai-adversaries-enterprise-risk
- Form 8-K, Item 1.05, bank holding company, filed 11 May 2026. https://www.sec.gov/Archives/edgar/data/1605301/000160530126000021/cbfv-20260507.htm
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, July 2024. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
- New York State Department of Financial Services, industry letter on cybersecurity risks arising from artificial intelligence, 16 October 2024. https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks
- 16 CFR 314.4, Standards for Safeguarding Customer Information. https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4
- CIS Controls v8.1, Safeguard 2.1. https://controls-assessment-specification.readthedocs.io/en/latest/control-2/control-2.1.html
- Microsoft 365 enterprise plans and pricing, read August 2026. https://www.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-plans-and-pricing
---
ARTVS measures AI use from software spend records and an interview-based intake, not from network or endpoint instrumentation.