Understanding and managing shadow IT: Key resources for your business strategy

Artificial intelligence has become an integral part of everyday work, but at the same time, there is uncertainty about its use in companies. While the potential is immense, the uncontrolled use of AI tools in the enterprise also poses significant risks. This is what we call "Shadow AI": the use of generative AI and other AI applications by employees that occurs outside of official IT guidelines and without security safeguards. With NENNA, you can use any AI securely, and we want to enable companies to work with AI fully and securely at the same time.

This type of Shadow IT is not new, but it is gaining a new dimension in the age of AI. Sensitive corporate data, confidential customer data or intellectual property can unwittingly be transferred to external AI models whose data protection standards do not meet your company's compliance requirements. The consequences can range from data leaks and competitive disadvantages to massive reputational damage and legal consequences.

For corporate decision makers, IT managers and compliance officers, it is essential to understand the dynamics of Shadow AI and to develop effective strategies. In this NENNA GUIDE article, we have curated and summarised the most relevant studies, articles and guidelines for you, in order to provide you with a well-founded overview and enable practical recommendations for action.

Curated reading recommendations on the topic of Shadow AI

1. The reality of Shadow AI: What is it and how widespread is it?

The following sources provide an excellent introduction to the topic and shed light on how deeply rooted Shadow AI already is in companies and what initial challenges arise from this.

Guide "Generative AI in the Enterprise" (Guide, Bitkom e.V.)

This Bitkom guide shows how widespread the use of generative AI, often through employees' private applications, already is in German companies. It warns of the risks of uncontrolled "Shadow AI" while offering concrete recommendations on how companies can promote a responsible and data-protection-compliant approach to AI through clear rules, secure access and transparency requirements. A must-read for strategy development.

Press release "Employees increasingly use Shadow AI" (Bitkom e.V., Press Release / Study)

An additional Bitkom survey proves that many employees use private AI tools in their daily work, while companies often do not yet provide clear guidelines or their own solutions. The report highlights that this "wild growth of AI" leads to significant Shadow AI. For decision makers, it provides valuable insights into the prevalence and recommendations on how to minimize risks and promote productive use through clear guidelines and secure AI tools.

2. Concrete risks: Data leaks, control and Trojan horses

These articles dive deeper into the specific dangers of Shadow AI, showing how quickly sensitive information can leak out of control and what new entry points for cyber threats are being created.

How safe are my secrets with ChatGPT? (Spiegel, Article)

The SPIEGEL article reveals how insecure handling confidential data with external chatbots like ChatGPT can be. It explains that access by third parties or authorities to chat history cannot be ruled out, and highlights the limited control options over stored data. For companies, this is a clear warning to recognize the risks of uncontrolled use of external AI systems and to avoid the potential loss of sensitive information.

Why AI browsers turn out to be Trojan horses (Süddeutsche Zeitung, Article)

Cybersecurity expert Mirko Ross explains in this SZ article how new AI browsers, which integrate AI directly into the operating system, offer convenience but pose immense risks to data protection and information security. The text illustrates what sensitive data is required for these browsers to function and how this creates new entry points for abuse or undetected Shadow AI. An important food for thought for companies that take the security of their endpoints and the protection of their data seriously.

3. Perspectives and strategies: Employee acceptance, management and cybersecurity

The following studies offer comprehensive insights into global trends, strategic approaches to AI integration and the overarching cybersecurity challenges that are also exacerbated by Shadow AI.

Trust, attitudes and use of AI: A global study 2025 (KPMG International & University of Melbourne, Study 2025)

This global study by KPMG and the University of Melbourne examines employee attitudes towards AI in the workplace. For companies, it is crucial to understand how employees perceive and use AI. The study provides valuable data on acceptance, but also on the fears that can encourage the uncontrolled spread of Shadow AI. It helps to ground internal communication and strategy development for secure and effective AI integration.

Agentic enterprise 2028: A blueprint for cost savings, job creation, and faster growth through agentic AI (Deloitte, Study 2025)

Deloitte describes in this study how companies can increase efficiency and innovative strength through the strategic use of "agentic AI" (autonomous systems). The report explicitly warns against bad investments and uncontrolled "Shadow AI initiatives" outside official structures. It provides strategic guidance on how companies can scale autonomy and AI responsibly to harness the benefits while managing the risks of Shadow AI.

Global Cybersecurity Outlook 2025. Insight Report. (World Economic Forum in collaboration with Accenture, Insight Report)

This report by the World Economic Forum highlights the growing complexity of the global cyber landscape and the increasing risks posed by the abuse of new technologies like AI by cybercriminals. It underscores the need for a "security-first" approach. For companies, this is an important reminder that Shadow AI is not just an internal compliance issue, but represents a significant cyber risk that must be integrated into the overall security strategy.

Steal, deal and repeat – How cybercriminals trade and exploit your data (Europol, Report IOCTA: Internet Organised Crime Threat Assessment 2025)

Europol's IOCTA report analyses how cybercriminals obtain and abuse personal and corporate data. It highlights that alongside system vulnerabilities, human error, such as the careless use of external AI tools, is often exploited. For companies, this report is essential for understanding the external threat landscapes where information could unwittingly be fed through Shadow AI.

Getting a grip on Shadow AI: NENNA.AI is your partner

Tackling Shadow AI and establishing secure AI use in the enterprise is no easy task, but it is an essential one. Given these complex challenges, it is crucial for companies to act proactively and follow a clear strategy.

With our AI Privacy Platform, NENNA.AI offers customized solutions to use the potential of AI securely, compliantly and in line with data protection. Whether it is about bringing Shadow AI under control, protecting sensitive data in prompts and documents, or establishing a secure, GDPR-compliant AI infrastructure in the company, we are your partner.

Discover how NENNA.AI makes your AI strategy secure with "No leaks, no drama" – right here:

Sources:

Bitkom e.V. (2025). Guide "Generative AI in the Enterprise". https://www.bitkom.org/Bitkom/Publikationen/Generative-KI-im-Unternehmen

Bitkom e.V. (2025). Press release "Employees increasingly use Shadow AI". https://www.bitkom.org/Presse/Presseinformation/Beschaeftigte-nutzen-Schatten-KI

Böhm, M., & Breithut, J. (2025, 26 October). How safe are secrets with OpenAI's chatbot? Der Spiegel. https://www.spiegel.de/netzwelt/web/chatgpt-wie-sicher-sind-geheimnisse-beim-chatbot-von-openai-a-62cdb47d-0ffe-4d97-8ee1-13e2432d128d

Ross, M. (2025, 31 October). Why AI browsers turn out to be Trojan horses. SZ Dossier / Süddeutsche Zeitung. https://www.sz-dossier.de/gastbeitraege/warum-sich-ki-browser-als-trojanische-pfeide-erweisen-8e058ef2

KPMG International & University of Melbourne. (2025). Trust, attitudes and use of AI: A global study 2025. https://assets.kpmg.com/content/dam/kpmgsites/ae/pdf/trust-attitudes-and-use-of-ai-global-report.pdf.coredownload.inline.pdf

Deloitte. (2025, September). Agentic enterprise 2028: A blueprint for cost savings, job creation, and faster growth through agentic AI. Deloitte. https://www.deloitte.com/content/dam/assets-zone3/us/en/docs/services/consulting/2025/agentic-ai-enterprise-2028.pdf

World Economic Forum in collaboration with Accenture. (2025, January). Global Cybersecurity Outlook 2025. Insight Report. https://www.weforum.org/publications/global-cybersecurity-outlook-2025/

Europol. (2025). Steal, deal and repeat – How cybercriminals trade and exploit your data. Publications Office of the European Union, Luxembourg. https://www.europol.europa.eu/publication-events/main-reports/steal-deal-and-repeat-how-cybercriminals-trade-and-exploit-your-data