AI Boss Tools | Diagnostic 09 • Back to the Hub
Most organisations have staff using AI tools that were never approved. IBM's 2025 breach study found shadow AI involved in one in five data breaches, and it added US$670,000 to the average breach cost. Twelve questions measure how exposed your organisation is and where the gaps sit.
Shadow AI means staff using AI tools for work without approval or oversight from IT. It is common because public AI tools are free and easy to reach, and because many organisations have not given staff an approved option. When an employee pastes customer records into a public chatbot, the vendor may store that data, review it, or use it for training, and the security team usually has no record that it happened.
In IBM's 2025 study, 63 percent of breached organisations had no AI governance policy. Where shadow AI was involved in a breach, 65 percent of the incidents exposed customer personal information. Banning AI tools tends to make the problem worse, because staff keep using them without telling anyone. The organisations that manage this well give staff approved tools, publish clear rules about data, and keep visibility over usage.
The diagnostic covers four areas: your policies, your technical controls, how your staff behave in practice, and whether you could detect a problem. If you have never checked something, choose the answer that says so.
Shadow AI featured in 20 percent of breaches, added up to US$670,000 to average breach cost, and 97 percent of AI-related breaches lacked proper access controls.
63 percent of organisations studied had no AI governance policy to manage AI or prevent shadow AI use.
A score for every dimension, a median benchmark to compare against, a specific next step for each dimension, and a one-pager sized for a board pack. Your name and email open it, and there is no charge.