Artificial Intelligence · Cybersecurity · Small Business Technology
Your Employees Are Already Using AI. Do You Know What They're Feeding It?
By Tom Daugherty · November 10, 2026
Here's a safe bet. Someone at your company used a free AI chatbot this week to get work done. They pasted in an email to clean up, a spreadsheet to summarize, or a client letter to make sound more polished. They weren't trying to cause trouble. They were trying to save time.
That's shadow AI, and it's almost certainly already happening in your office.
The numbers are hard to ignore
A June 2026 PagerDuty survey found that 59 percent of employees use AI at work without IT oversight, and only 16 percent use it with oversight. Among people who had shared work information with public AI tools, 34 percent said they'd shared customer data and 31 percent financial information or confidential documents.
Cyberhaven's 2026 research found roughly 4 in 10 pieces of data flowing into AI tools contain sensitive information. And blocking the obvious sites doesn't settle it either. UpGuard reported that 41 percent of employees find a way around blocked AI apps.
Why this matters more for regulated firms
When client information goes into a free AI tool on a personal account, it leaves your control. You don't know where it's stored, how long it's kept, or whether it's used to train the next version of the model. For a medical practice that's a HIPAA question. For a law firm it's a confidentiality question. For an accounting or wealth management firm it's a client trust question, and possibly a regulatory one.
Healthcare is a good example of how fast this moves. A February 2026 survey found 57 percent of healthcare professionals had encountered or used unauthorized AI tools, often to draft notes and summarize records.
It also costs real money when it goes wrong. Breaches involving shadow AI have been reported at about $400,000 above the average breach.
Banning it doesn't work
The instinct for a lot of owners is to just say no. The problem is that your people are using these tools because they genuinely help, and a ban mostly pushes the activity onto personal phones and personal accounts where you have even less visibility.
Most small businesses don't have a policy at all. According to ISACA, only 38 percent of organizations had a formal, comprehensive AI policy in 2026, and a quarter had none whatsoever. If your company is in that group, you're not alone, but you are exposed.
The better path is giving your team a safe, approved way to use AI while making sure sensitive data can't wander out the door. Getting that balance right takes knowing what tools are in use, what data is at risk, and what you already own in Microsoft 365 that can help.
Let us take a look
You don't need to figure this out alone. Cracked Cloud helps small and midsize businesses get a handle on how AI is being used across their team and put the right guardrails in place without killing productivity. It starts with our free Microsoft 365 Security Assessment, which gives you a clear picture of where your data stands and a plain-English list of what to do next.
Book a quick 20-minute intro chat to get started.
