Organizations need visibility into which AI tools employees actually use — not just those IT has approved or procurement has purchased. ActivTrak’s Behavioral Work Dataset closes this visibility gap by identifying AI applications in use, revealing adoption patterns and supporting more informed decisions about governance, security and compliance.
Key takeaways:
- Shadow AI creates security and compliance risks.
- Traditional monitoring tools leave gaps in AI visibility.
- Behavioral work data reveals real-world AI adoption.
- Context is essential for effective AI governance.
- Continuous monitoring turns AI visibility into actionable governance.
Why shadow AI is a growing concern for business leaders
Shadow AI is a topic that’s keeping leaders up at night. CEOs to CISOs to CDOs all fear seeing stories like these in the headlines:
- Community Bank filed a disclosure with the SEC after an unauthorized AI application exposed customer names, Social Security numbers and dates of birth.
- Samsung faced a similar challenge when engineers reportedly uploaded internal source code to ChatGPT. The company responded by restricting generative AI tools on company devices and networks while asking employees to avoid entering company information into those tools on personal devices.
Unfortunately, these companies are not alone. IBM‘s 2025 Cost of a Data Breach report shows that among the organizations studied, 20% experienced breaches involving shadow AI, with those incidents adding an average of $670,000 to breach costs.
Business leaders face a growing challenge: How do you encourage productive AI adoption while managing risks you may not know exist? Addressing shadow AI requires more than blocking applications or updating acceptable-use policies. It starts with understanding how teams across the organization actually use AI.
Why traditional approaches leave gaps in AI visibility
Shadow AI refers to AI tools used for work purposes without appropriate organizational review or approval. Picture an employee using their personal AI account to knock out work tasks — like feeding customer notes into a chatbot for a quick summary or asking it to write a chunk of code. Other examples of Shadow AI include installing a helpful AI browser extension that quietly processes company data through a third-party service.
Companies typically rely on several sources to see which AI tools are in use:
- Procurement records and approved tool lists identify applications an organization has purchased or authorized, but not necessarily the tools employees independently adopt.
- Employee surveys and manual registries provide useful context about AI adoption but depend on employees knowing, remembering and reporting which tools they use.
- Network security tools identify traffic to known AI services within their coverage, but may not capture activity outside monitored networks or on unmanaged devices.
- AI gateways provide detailed records of interactions with connected models, but don’t necessarily cover tools employees access independently.
Each serves an important purpose, but none provides a complete picture of AI adoption on its own.
The landscape is shifting fast. According to ActivTrak’s 2026 State of the Workplace report, which looked at over 443 million hours of work data across more than 1,100 companies, the average organization jumped from using two AI tools in 2023 to seven in 2025. In fact, 83% of companies now use six or more.
With the explosion of apps, keeping track of tools through outdated procurement lists and periodic audits is nearly impossible. Organizations need real-time visibility into how AI is actually used as it evolves, so leaders can tie insights back into everyday security and governance rules.
How behavioral work data adds visibility
Behavioral work data shows how work gets done across systems: how teams use applications and AI tools, hold meetings, hand off work and build workarounds. It reveals which tools employees rely on, how frequently they use them and how those patterns shift over time. This brings AI tools into full view, helping organizations spot new applications as they emerge and see how adoption evolves naturally.
Rather than relying on guesswork, organizations can use these insights to answer practical questions:
- Which AI tools need further review or approval?
- Where is AI adoption concentrated across teams and departments?
- Which tools are part of regular workflows versus occasional experiments?
- How does real-world usage compare with the approved AI tools and existing software investments?
These insights help organizations determine where to focus attention. A newly detected application used briefly by a small group may warrant a different response than an unapproved tool used extensively across multiple departments. They do more than just manage risk — they show where employees find real value in AI, helping leaders decide which tools to officially support or where safer alternatives are needed.
Want to see what this looks like in practice? Watch our on-demand webinar to see how ActivTrak helps uncover shadow AI, investigate unexpected usage patterns and turn workforce data into actionable governance insights:
Four steps to turn AI usage visibility into actionable governance
Having a full picture of AI usage is a great starting point, but visibility alone won’t protect your data. The real challenge is turning that raw usage data into a repeatable process for vetting tools, managing risks and monitoring changes over time.
Step 1: Establish a baseline of real-world AI usage
Start by mapping the AI tools employees use every day, including shadow tools that IT never approved.
Look at usage by application and adoption by team, including how often and how long each tool is used. When you compare actual activity against procurement records, you’ll quickly spot tools that need formal review.
This baseline helps organizations understand the scale of AI adoption before deciding which tools to approve, restrict or investigate. Widespread adoption of an unapproved app isn’t always a red flag—it often signals a legitimate gap in your official software stack that leadership should address.
Step 2: Classify tools and assess potential risks
Once you know which AI tools are in use, establish a consistent vetting process. Sort applications into three buckets: approved, unapproved and awaiting review.
Approval status alone doesn’t establish risk. You also need to look at context — the tool’s capabilities, the data involved and available security controls.
- Low Risk: An employee using an external AI tool to brainstorm generic marketing angles.
- High Risk: An employee feeding proprietary customer contracts into a public LLM to draft a summary.
Behavioral work data helps you prioritize reviews by showing where app usage is spiking, allowing you to streamline low-risk approvals and focus deep security evaluations where they matter most.
Step 3: Investigate unfamiliar activity before taking action
Not every unapproved AI tool calls for an immediate restriction. Understanding why and when a tool was used can help organizations distinguish legitimate experimentation from ongoing security hazards.
Real-world example: ActivTrak’s own product team noticed a sudden spike in usage of a new AI agent tool among five employees — a classic Shadow AI signal. But looking closer revealed the usage all happened on a single Tuesday during a company hackathon. The engineers were simply experimenting for an event, not embedding an unvetted tool into daily operations.
Investigating context before taking action lets you keep company data secure without accidentally punishing innovation.
Step 4: Monitor usage trends and document governance decisions
As new AI tools emerge and usage patterns change, organizations need continuous visibility paired with documented decision-making to demonstrate proactive risk management.
To keep this process running smoothly, assign clear ownership for AI reviews and track key governance metrics:
- Tools detected vs. reviewed: Total apps identified compared to those vetted
- Approval velocity: The average time it takes to resolve a flag or approve a request
- Assessment completeness: Percentage of high-usage tools with completed risk reviews
From AI visibility to informed governance
The goal of AI governance isn’t to crush innovation or stop people from experimenting with AI. It’s about getting enough visibility to make smart, informed decisions.
With a clear, continuous view into actual work patterns, organizations can protect sensitive data without putting the brakes on tools that drive real business value. As AI becomes deeply woven into everyday workflows, finding that balance between safety and speed will be the ultimate competitive advantage.
