TL;DR

Shadow AI is a visibility gap: AI used without the organization knowing about or approving that use. AI sprawl is a portfolio problem: overlapping AI apps, agents, owners and costs piling up.
The two vary independently. One unreviewed chatbot can be shadow AI with little sprawl, and twenty registered, approved agents can be sprawl with no shadow AI at all.
Evidence of hidden use is real but easy to overstate. A personal account is a warning sign rather than proof of a violation, and IBM's link between shadow AI and breach cost is an association.
Fixing either starts with a live inventory of use cases and systems, each with an owner, data flows, permissions, cost and a retirement trigger. A list of vendor names shows neither problem.

Security teams often talk about shadow AI and AI sprawl as if both meant the same thing, too much AI with too little control. They are different conditions, and mixing them up leads to the wrong measurements. A count of AI vendors will not tell you who pasted a contract into a personal chatbot, and blocking unapproved sites will not explain why twenty teams built the same agent.

We read the surveys, telemetry, breach data and public guidance behind both terms. Here is what each means, what the evidence supports, how the risks differ and which controls fit.

Shadow AI vs AI sprawl: what is the difference?

Shadow AI is AI used or deployed without the organization's knowledge, approval or effective governance of that use. AI sprawl is the multiplication and fragmentation of AI applications, models, features, agents, accounts, integrations and costs across an organization. Shadow AI is a visibility and authorization gap. AI sprawl is a portfolio and lifecycle problem.

Neither term has an agreed measurement standard, so these are working definitions. They follow IBM's explainer What is AI agent sprawl?, which separates sprawl from shadow AI, and the inventory and lifecycle outcomes in NIST's AI Risk Management Framework (AI RMF). An organization can have either problem, or both at once.

Shadow AI is about one use

The unit can be small, from a personal account or browser extension to an AI feature inside approved software. A use becomes shadow when the organization has no adequate knowledge or authorization of what is used, where the data goes or what permissions it holds.

Microsoft's guidance on why shadow AI governance matters counts both tools employees choose for themselves and agents deployed inside the enterprise without registration or an owner. A tool does not have to be malicious or publicly hosted to qualify.

AI sprawl is about the whole portfolio

Sprawl describes the shape of the environment: systems that multiply and duplicate, ownership that fragments, controls that stop matching, and dependencies that are hard to see and maintain. Counting vendors is too narrow, because one approved SaaS application can add many AI features, agents, model endpoints and usage-based charges.

Definitions vary even between large vendors. IBM notes that approved agents can still contribute to sprawl, while Microsoft's guidance on reducing autonomous agentic AI risk defines agent sprawl more narrowly, as uncontrolled proliferation of unmanaged or over-permissioned agents.

	Shadow AI	AI sprawl
What it is	A visibility and authorization gap	A portfolio and lifecycle problem
The question it asks	Who is using which AI capability, with what data and permissions, under whose authority?	How many overlapping systems exist, who owns them, what value they produce, and when should they be consolidated or retired?
Unit of analysis	One use: an account, extension, endpoint, embedded feature, local model or agent	The portfolio: apps, features, agents, models, integrations, owners and spend
Evidence to collect	Employee disclosures and use-case intake, plus identity, expense, network, API, extension and cloud logs where lawful and available	An inventory of use cases, apps, agents, models, integrations, owners, spend, evaluations and dependencies
Main controls	Discovery, review, identity and data controls	Inventory quality, architecture, reuse, cost allocation, evaluation and retirement

Four illustrative cases show how the labels apply. A personal chatbot used on confidential work is shadow AI with little sprawl. Twenty approved, registered teams that each build a similar support agent are likely sprawl with no shadow AI. A central AI workspace serving several distinct, evaluated uses is broad adoption, which is not necessarily a problem. The fourth case is an approved HR application that turns on a new AI feature and sends employee data to another processor without review. It may be both, because the earlier vendor approval never covered that data flow.

Shadow AI and AI sprawl are separate questions, so one case can rate high on either, both or neither. The four cases are illustrative classifications, not reported incidents.

Shadow IT, BYOAI and personal accounts

Shadow IT is the older, broader category of technology used outside organizational control, and shadow AI is its AI-specific form. Bring your own AI (BYOAI) describes where a tool came from, which on its own says nothing about whether it is authorized. A personal account may be allowed for public information, and an enterprise-licensed tool can still be used outside its approved purpose.

Vendor reports differ on this. Netskope treats much personal-account activity as shadow AI in its Cloud and Threat Report: Generative AI 2025, while a stricter test checks policy and actual governance first. A personal login is a reason to look closer, and on its own it proves nothing about policy.

Why do employees bring their own AI?

AI is easy to get and it helps with real work. In a peer-reviewed field study of a staged rollout to 5,172 customer-support agents, Brynjolfsson, Li and Raymond found that access to an AI assistant raised resolved issues per hour by about 15% on average, with larger gains for less experienced workers (Generative AI at Work, Quarterly Journal of Economics, 2025). In a randomized experiment on professional writing tasks, Noy and Zhang found that ChatGPT users finished 40% faster and received 18% higher quality ratings (Science, 2023).

Neither study looked at unauthorized use or sprawl, and the estimates do not carry over unchanged to clinical, legal, engineering or agentic work. They help explain the pull, and suggest that blanket suppression may throw away real value. The next step, adoption outrunning review until deployments fragment, is a plausible interpretation that has not been shown as a general rule.

How common is shadow AI?

Microsoft and LinkedIn's 2024 Work Trend Index surveyed 31,000 desk workers online, 1,000 in each of 31 markets, in February and March 2024. Of those surveyed, 75% said they used AI at work. Among the AI users, 78% brought their own AI tools and 52% were reluctant to admit using AI for their most important tasks.

Reluctance fits with hidden use but does not show why each person was reluctant. The figures are self-reported and describe early 2024, so they are not a current prevalence estimate.

Netskope's Cloud and Threat Report: Shadow AI and Agentic AI 2025 measures traffic instead. It uses secure web gateway telemetry from a subset of consenting customers, observed from February to May 2025. (A secure web gateway is the proxy that inspects and filters employees' web traffic.) In that subset, the average organization had 7 active SaaS generative AI apps in May, up from 5.6 in February, and uploaded 8.2 GB of data to them per month. Netskope also found that 60% of observed SaaS generative AI users used personal, unmanaged apps.

A gateway sees only what passes through it. It can miss personal devices, locally run models, embedded AI features and traffic that bypasses it, and Netskope's customers are not a random sample of enterprises.

Why the survey and telemetry numbers disagree

Put Microsoft's 75% next to Netskope's May 2025 figure of 7.6% of users actively using SaaS generative AI apps, and it looks like a collapse in use. One is self-reported use of any AI among surveyed desk workers. The other is observed activity in direct generative AI apps across one vendor's covered workforce, and it leaves out AI features embedded in other applications, which Netskope reports are widely used.

Populations, instruments, time windows and definitions all differ, so these numbers should be neither read as a trend nor averaged.

Each headline number is a share of a different group, measured a different way. Read the denominator before the percentage, and do not compare or average across studies. Sources: Microsoft and LinkedIn (2024), Netskope Threat Labs (2025), IBM and Ponemon Institute (2025).

Agents change what sprawl looks like

Microsoft reported in February 2026 that over 80% of Fortune 500 companies had an active agent built with Copilot Studio or Agent Builder, meaning at least one real engagement or autonomous run in a 28-day period in November 2025 (Microsoft Security, Cyber Pulse). That shows adoption inside Microsoft's ecosystem, and it neither counts all agents nor measures how well they are governed.

How do the risks of shadow AI and AI sprawl differ?

A chatbot session can send a prompt, an attachment or copied text to a provider, and that material may be confidential or regulated. What happens next depends on the product tier, settings, contract, retention, subprocessors and location, and not every prompt trains a model. OpenAI, for example, states that it does not use business and API customer inputs or outputs for training by default (OpenAI business data privacy), while its consumer products have separate data controls.

Shadow AI raises uncertainty at the entry point. The security team may not know the tool exists, what is being sent, whether a contract covers it, or how to revoke access and investigate a suspected disclosure. Sprawl adds burden after entry, as duplicate data connections, model versions, prompts, agents, owners, permissions, logs, bills and renewal dates drift apart.

The two feed each other. An approved platform that lets users create agents without registering them grows shadow AI inside a sanctioned tool, and overlapping approved products can push staff toward personal accounts for convenience. These mechanisms are inferred from system architecture and from NIST and NCSC guidance, including NCSC's Guidelines for secure AI system development. Nobody has measured them as breach multipliers.

Shadow AI is uncertainty at the point where data enters an AI tool. Sprawl is the burden that builds up after entry, and each one feeds the other. These mechanisms are inferred from NIST and NCSC guidance and have not been measured.

Agents can act as well as read

Agents add a separate mechanism, because they can take actions through tools and credentials. Prompt injection is an attack that hides hostile instructions in material the agent reads, such as a document or an email. Excessive agency means the agent holds more permissions or reach than its task requires, so whatever it is tricked into doing touches more systems.

The OWASP Top 10 for LLM Applications 2025 lists prompt injection, sensitive information disclosure and excessive agency as distinct failure modes. A taxonomy entry is not evidence that every deployed agent is exploitable. NIST's National Cybersecurity Center of Excellence (NCCoE) still treats authorization, audit and delegated identity for agents as open questions in its February 2026 concept paper on agent identity and authorization.

Does shadow AI increase breach costs?

IBM's Cost of a Data Breach Report 2025, conducted by the Ponemon Institute and sponsored and analyzed by IBM, studied 600 organizations with breaches between March 2024 and February 2025. IBM reported that 20% of them had a breach linked to shadow AI. Organizations with high shadow AI use had a mean breach cost $670,000 higher than those with low or no shadow AI, and incidents involving shadow AI more often included personal information and intellectual property than the study's average breach.

Two limits matter. The 20% is a share of organizations that had already been breached, so it is not the chance that any given organization will be breached. The cost gap is an association, and the public release does not show the case selection, uncertainty interval or confounder adjustment needed to call it causal. Organizations with more shadow AI may also differ in size, data volume, security maturity and detection.

Netskope's Generative AI 2025 report adds earlier evidence: policy violations involving source code, regulated data, intellectual property and secrets in traffic to generative AI apps. Those are attempted or completed transfers within monitored traffic, and they do not confirm external disclosure or harm.

How do you measure AI sprawl?

App count is the obvious metric, and it can mislead. Zylo's 2026 SaaS Management Index, drawn from its customers' license and spend data, reports that the average SaaS portfolio stayed near 305 applications while spending on AI-native applications grew 108% year over year. AI features and consumption pricing can grow inside a stable app count.

Not every rise in spend is sprawl, since higher prices, heavier use and valuable new capabilities raise costs too, and Zylo's customers are not a random sample. Netskope, meanwhile, saw direct app counts rise in its subset. Both can be true, because apps, agents, features, connections, identities and spend move independently.

Measures closer to waste and risk include the number of systems serving a duplicate purpose, the number of dormant assets, and cost and quality per useful outcome.

What should security teams do about shadow AI and sprawl?

These steps are reasoned from NIST, UK Government, NCSC and Microsoft guidance and the failure modes above. Nobody has tested them together in a controlled trial.

Keep a live inventory of use cases and systems. A vendor list misses features, agents and data flows. The UK Government's AI Playbook asks for a live inventory with purpose, data, ownership, risk and dates, and NCSC adds models, prompts and logs to lifecycle documentation.
Make the approved route easy to use. Give common tasks a usable sanctioned tool. Track how long it takes to approve a low-risk use, and the share of significant uses with an owner, an approved data path and a review date.
Review the actual task and data. Approval status is only part of the risk: an authorized customer-facing system can still give wrong advice, and an unapproved tool used only on public text may carry little data risk. Scale the review to data sensitivity, decision impact, autonomy and permissions, and restrict high-risk transfers.
Give every agent its own identity. Microsoft recommends registration, a named owner, least-privilege access, a unique identity and eventual retirement for each agent. Gate consequential actions, test prompt-injection paths, and track how many agents have a scoped credential, an auditable action chain and a tested shutdown path.
Reassess familiar software when its AI changes. When an approved product adds a feature that changes how or why data is processed, review that feature, and track coverage of changed features rather than approved vendor names.
Retire what no longer earns its cost or risk. Set lifecycle reviews and expiry dates, reuse or retire redundant systems, and compare alternatives on task-level value.

A useful inventory record holds, at minimum:

Purpose and owner, plus users and the people affected
Model or provider and version
Data classes and destinations
Integrations and permissions
Human review and testing
Contract and retention settings
Cost and approval scope
Last review and retirement trigger

This list is a suggested synthesis of UK, NCSC and NIST guidance, and no standard mandates it.

A sanctioned route in practice: Redbox

The UK Government's algorithmic transparency record for Redbox documents one approach. Redbox is a multi-model assistant, built because civil servants lacked an approved LLM tool for information up to the official-sensitive classification. It replaced an unknown number of small accounts across departments with one sanctioned access route and account arrangement.

The record says 2,000 civil servants across three bodies used it as of February 2025, and it prohibits entering personally identifiable information. It also calls Redbox a beta with evaluation ongoing, so it does not show that Redbox eliminated shadow AI, saved money or improved quality.

Does the EU AI Act cover shadow AI?

The EU AI Act regulates specified uses and actors, and it does not treat shadow AI or AI sprawl as legal categories. Whether it applies depends on the system, your role and the use case. The European Commission's Navigating the AI Act FAQ, checked on 21 October 2026, says general application began on 2 August 2026. A July 2026 amendment moved the main obligations for high-risk uses listed in Annex III to 2 December 2027 (consolidated Regulation (EU) 2024/1689).

Caveats

The share of genuinely unauthorized use is unknown. No survey or telemetry set here gives an independently verified, cross-industry figure once policy is checked.
The best sprawl metric is unknown. Vendor datasets measure different slices, and none shows which measure best predicts harm or waste.
Sanctioned routes are untested. Nobody has shown whether a fast approved route reduces risky use or moves it to channels monitoring misses.
Inventories are recommended practice. NIST, the UK Government and NCSC agree on them, but no randomized study shows that an inventory alone reduces incidents.

Shadow AI vs AI Sprawl: What Each Is and How to Control It