2025年影子人工智能（AI）状况报告_24页_16mb

2025 State of Shadow AI Report Summary

Core Content

This report highlights the growing prevalence and risks of Shadow AI in enterprise environments, emphasizing the need for proactive governance and security strategies. Shadow AI refers to AI applications adopted by employees without IT or security approval, creating significant security blind spots and increasing the risk of data breaches and compliance issues.

Main Findings

Finding 1: 10 Shadow AI Apps Putting Your Data at Risk

• Three apps (Jivrus Technologies, Happytalk, and Stability AI) received failing grades due to severe security deficiencies, including lack of encryption, MFA, and audit logging.
• Seven high-risk apps (HomeDesignsAI, agent.ai, RedactAI, Copy.ai, Clueify, CreativeX, and WaveAI) lack fundamental security controls, exposing sensitive data to potential breaches.
• Organizations using these apps risk unauthorized access to intellectual property, customer data, and internal systems.

Finding 2: The Popularity Trap

• High adoption doesn't equate to high security. Popular AI tools like CreativeX and Otter.ai have low security scores, indicating that they are not enterprise-ready.
• Employees often choose AI tools based on features and convenience rather than security, leading to widespread use of insecure applications.
• Security leaders must guide employees toward vetted, secure alternatives to avoid enterprise-wide vulnerabilities.

Finding 3: OpenAI Dominates Shadow AI Usage

• OpenAI accounts for 53% of all Shadow AI usage across enterprises, with over 10,000 users in the study.
• Its dominance creates a single point of failure, as any security incident or policy change at OpenAI could affect a large portion of enterprise AI workflows.
• Security teams should implement OpenAI-specific monitoring and controls, including data classification, approved use cases, and mandatory training.

Finding 4: Shadow AI Isn't Temporary

• Shadow AI tools persist for months or even years, with some running for over 400 days.
• Long-term usage increases the risk of data exposure and compliance violations, as these tools become deeply embedded in workflows.
• Security teams must conduct audits for any AI tool with over 60 days of usage and ensure formal approval or migration to secure alternatives.

Finding 5: Small Companies Face Disproportionate Risk

• 27% of employees in companies with 11-50 employees use unsanctioned AI tools.
• These organizations lack the resources and infrastructure to manage Shadow AI effectively, making them more vulnerable.
• A targeted approach is recommended, such as blocking or monitoring high-risk tools like email, customer data, and code generation apps.

Key Recommendations for Security Leaders

1. Implement Real-Time Shadow AI Discovery

   • Use continuous discovery tools to identify all AI applications used by employees, including web apps and browser extensions.
   • Monitor network traffic, SaaS logs, and OAuth authorizations for visibility.

2. Establish OpenAI-Specific Controls

   • Create dedicated policies for OpenAI usage, including data classification, approved use cases, and mandatory security training.
   • Monitor integrations with enterprise systems like Box, HubSpot, and Google Drive.

3. Create and Publish Pre-Approved AI Tool Lists

   • Provide employees with vetted alternatives for common AI use cases (e.g., chatbots, writing assistants).
   • Update the list regularly to reflect new tools and security assessments.

4. Prioritize High-Risk Tool Remediation

   • Focus on F-rated apps first, as they pose the greatest risk.
   • Conduct formal security assessments within 30 days for tools with over 90 days of usage.

5. Scale Security for Smaller Teams

   • Use a "default deny" approach for organizations with limited resources.
   • Whitelist only essential, secure AI tools to reduce the burden on security teams.

Leveraging Reco to Tackle Shadow AI

Reco offers a dynamic SaaS security platform that detects and governs Shadow AI through:

• Multi-layered detection using identity provider integration, email metadata analysis, and NLP matching.
• Real-time alerts for new Shadow AI deployments.
• Behavioral analytics to identify long-term usage patterns and embedded dependencies.

Reco's AI-based graph technology maps SaaS applications, identities, and relationships across the enterprise, supporting over 200 SaaS apps and detecting major AI tools like ChatGPT, Claude, and Microsoft Copilot.

Conclusion

Shadow AI is a critical issue that is here to stay. It has created a new security landscape where traditional methods are insufficient. Security teams must act now to implement discovery and governance solutions to mitigate risks and ensure compliance. With the right tools and strategies, Shadow AI can be managed and turned into a competitive advantage rather than a liability.

Summary of Risks and Impacts

• Shadow AI creates unknown unknowns in the security environment.
• Data loss and compliance violations are significant risks, especially with long-term usage.
• Small businesses are particularly vulnerable due to limited resources and high adoption rates.
• OpenAI's dominance amplifies the risk, as it processes data for over half of all enterprise AI users.

Final Note

The report underscores that Shadow AI is not a temporary trend but a growing security challenge. Organizations must get ahead of the risk by implementing robust governance and security measures. Reco provides the tools to do so effectively, ensuring that security keeps pace with AI adoption.