I have a confession that dates me: I was shadow IT. In the early cloud years I was one of those people in a department who got tired of waiting on a central provisioning ticket, pulled out a corporate card, and stood up what I needed in the cloud that afternoon. It was faster. It worked. And it drove our IT and security teams up the wall, because from where they sat I had just built production infrastructure they could not see, could not secure, and did not know existed.
I ran my first EC2 instance in 2009 the same way. Not because I was reckless, but because the sanctioned path was slow and the unsanctioned one was right there in a browser tab. That lived experience is the whole reason I am writing this. Because the exact same fight is back, at ten times the scale, and most organizations are about to lose it the same way they nearly lost the first one.
We Did Not Beat Shadow IT By Banning It
Here is the part everyone forgets. Shadow IT did not die because security got strict. Memos did not kill it. Blocking did not kill it. Every org that tried to win by locking down expense policy and threatening consequences just pushed the behavior further underground and made it more dangerous.
What actually worked was a platform. Companies stopped treating central IT as a gate you had to get through and started treating it as a paved road you wanted to be on. They built landing zones with guardrails baked in, self service catalogs, sane defaults, and identity that just worked. The sanctioned path became the easy path. And the moment the governed road was also the fast road, the shadow behavior dissolved on its own. Nobody swipes a personal card to route around a platform that is genuinely better than what they would build alone.
I made that argument at length in Your Platform Engineering Team Is Now Your AI Infrastructure Team: when the central platform is not good enough, teams build shadow platforms that fragment governance. The answer is not a separate highway. It is a wider paved road. Extend the IDP, do not fork it.
That lesson took a decade to internalize. We are about to relearn it in a fraction of the time.
The Rematch: Shadow GenAI
The first time around, shadow IT was a few dev teams with an AWS account. Contained, technical, a problem you could at least name and count. Shadow GenAI is that same dynamic with the population expanded to everyone. It is no longer a handful of engineers. It is every employee with a browser, and every one of them now has an agent one tab away.
The numbers landed this week and they are not subtle. Yahoo Finance reported on September 17 that 67% of workers use unapproved AI while enterprises are still shipping governance infrastructure, and coined a phrase worth stealing: the shadow agent gap, the disconnect between how work actually happens and how it is managed. A day earlier Deloitte found that 31% of GenAI users use it without their employer knowing, and UK workers spend roughly one billion pounds a year of their own money on GenAI for work. Read that last stat again. Employees are literally swiping their own cards to route around the sanctioned tool. That is my 2009 corporate card, reissued for the entire workforce.
And the data does not stay put. LayerX research surfaced by ETHRWorld found that 77% of employees paste data into GenAI prompts, and 82% of those pastes come from personal, unmanaged accounts. Source code, client proposals, PII, roadmap decks, all flowing into models nobody reviewed, through accounts nobody controls. Microsoft draws the useful distinction between the two forms of shadow AI: unsanctioned tools, and unsanctioned agents. CIO frames the same shift as the move from hidden apps to hidden autonomous systems that think, act, and decide. The unsanctioned thing is no longer infrastructure sitting still. It is autonomy taking action on your behalf.
One more beat, because it kills the comforting story that this is a junior developer problem. TrustedTech, citing Censuswide, found that senior decision makers are twice as likely to use unapproved AI as their own reports, 65% versus 31%. The people writing the acceptable use policy are the biggest violators of it. This is not a compliance gap you can train your way out of.
Who Protects What, And Why That Is A Trap
Lay out the responsibility model honestly and the problem becomes visible. IT and network protects the connection: transport, network segmentation, egress. Data and security protects the data: classification, DLP, encryption at rest and in motion. Both of those disciplines are mature and both are doing their jobs.
And nobody protects the business logic. Nobody owns the decisions the agent reasons its way through. I made this case in Rogue AI Agents Aren’t Flukes: an agent does not breach you by cracking TLS or dumping a database. It reasons toward a goal and takes actions, chaining tool calls and crossing a boundary nobody thought to close. No firewall inspects a decision. No DLP rule catches a judgment call.
When every department is quietly running its own agents, that gap stops being a corner case and becomes the whole surface. Security is no longer a team you hand off to at the end of a project. Security becomes everyone’s problem. And here is the trap: the instant a problem belongs to everyone and no single team owns it, it stops being a security problem at all. It becomes a governance problem. That is the line we just crossed.
Govern It The Way We Governed The Cloud
You cannot ban your way out of this. The surveys are unanimous that people will take the risk to hit a deadline, and the BYOAI reality is that when the sanctioned alternative is nonexistent or too slow, employees route around it every time. Blocking lost the first war. It will lose this one faster, because the population routing around you is a hundred times larger.
We won the first war with a platform, so build one again. A sanctioned agent platform where the governed path is the fast path. Google Cloud puts it well in its guidance to counter shadow agents: govern agents with the same rigor you apply to human managed accounts. Inside that platform, the enforcement layer is exactly the checklist I walked through in the agent governance post, so I will not re run it here: identity per agent, least privilege, guardrails, audit, and a tested kill switch. Treat agents like privileged digital workers, and make requesting a governed one easier than pasting a proposal into a personal chatbot. Same move as the landing zone. Same move as the paved road. New vehicle.
But a platform without an owner is just a project waiting to be abandoned. The reason shadow IT actually died is that someone was accountable for the paved road staying better than the ditch beside it, and that ownership cannot live inside security alone. This is where an AI Center of Excellence earns its name. Not a committee that meets once a quarter to rubber stamp tools, but a standing cross functional body with real authority: leaders from the business units who know what work people are actually trying to get done, HR who owns acceptable use and the human consequences of getting it wrong, IT who owns the platform and the connection, and security who owns the data and the containment. Put those four in a room with a shared mandate and you get a governance framework built around how people actually work. Leave any of them out and you get a framework built around how one function wishes people worked, which is exactly the framework everyone quietly ignores.
That distinction is the whole game. A CoE that optimizes for control writes rules that make the governed path slower than the shadow one, and users respond the only rational way they can, by going around it. A CoE that optimizes for enablement makes the sanctioned path genuinely faster and safer, and the shadow behavior loses its reason to exist. The framework has to work for the user, or the user will go their own way instead of taking the paved road. That is not a soft nicety. It is the entire mechanism by which the last decade of shadow IT was actually resolved. If you want the operating model, org structure, and staffing patterns for standing one up, AWS Prescriptive Guidance has a solid guide to building a Cloud Center of Excellence, and Atlan has a practical charter and roles playbook aimed specifically at agent governance. I am not going to turn this post into a how to build one. I only want you to walk away convinced that you need it, and that it cannot be security holding the pen alone.
The Takeaway
Shadow IT taught us the lesson once, and it was expensive. Regulation and blocking lost. Platforms and paved roads won. Shadow GenAI is the identical fight with the population expanded to your entire company and the clock running faster.
- Stop writing the ban. It did not work in 2009 and it will not work now.
- Name an owner for the business logic, because right now nobody has it.
- Stand up an AI Center of Excellence with BU, HR, IT, and security at the table, and give it the mandate to build the governance framework.
- Build the sanctioned agent platform before the ungoverned one becomes load bearing.
- Make the governed path the fast path, or your best people will keep swiping their own cards.
- Reuse the muscle you already have. Your platform team beat shadow IT. Point them at agents.
I was shadow IT once. It was the right instinct pointed at the wrong path, and the fix was never to punish the instinct. The fix was to build somewhere better to point it. The orgs that win the next eighteen months will be the ones who hand employees a governed agent platform before the ungoverned one becomes the thing everything quietly runs on. Build the road. They are already driving.
I have a confession that dates me: I was shadow IT. In the early cloud years I was one of those people in a department who got tired of waiting on a central provisioning ticket, pulled out a corporate card, and stood up what I needed in the cloud that afternoon. It was faster. It worked. And it drove our IT and security teams up the wall, because from where they sat I had just built production infrastructure they could not see, could not secure, and did not know existed.
I ran my first EC2 instance in 2009 the same way. Not because I was reckless, but because the sanctioned path was slow and the unsanctioned one was right there in a browser tab. That lived experience is the whole reason I am writing this. Because the exact same fight is back, at ten times the scale, and most organizations are about to lose it the same way they nearly lost the first one.
We Did Not Beat Shadow IT By Banning It
Here is the part everyone forgets. Shadow IT did not die because security got strict. Memos did not kill it. Blocking did not kill it. Every org that tried to win by locking down expense policy and threatening consequences just pushed the behavior further underground and made it more dangerous.
What actually worked was a platform. Companies stopped treating central IT as a gate you had to get through and started treating it as a paved road you wanted to be on. They built landing zones with guardrails baked in, self service catalogs, sane defaults, and identity that just worked. The sanctioned path became the easy path. And the moment the governed road was also the fast road, the shadow behavior dissolved on its own. Nobody swipes a personal card to route around a platform that is genuinely better than what they would build alone.
I made that argument at length in Your Platform Engineering Team Is Now Your AI Infrastructure Team: when the central platform is not good enough, teams build shadow platforms that fragment governance. The answer is not a separate highway. It is a wider paved road. Extend the IDP, do not fork it.
That lesson took a decade to internalize. We are about to relearn it in a fraction of the time.
The Rematch: Shadow GenAI
The first time around, shadow IT was a few dev teams with an AWS account. Contained, technical, a problem you could at least name and count. Shadow GenAI is that same dynamic with the population expanded to everyone. It is no longer a handful of engineers. It is every employee with a browser, and every one of them now has an agent one tab away.
The numbers landed this week and they are not subtle. Yahoo Finance reported on September 17 that 67% of workers use unapproved AI while enterprises are still shipping governance infrastructure, and coined a phrase worth stealing: the shadow agent gap, the disconnect between how work actually happens and how it is managed. A day earlier Deloitte found that 31% of GenAI users use it without their employer knowing, and UK workers spend roughly one billion pounds a year of their own money on GenAI for work. Read that last stat again. Employees are literally swiping their own cards to route around the sanctioned tool. That is my 2009 corporate card, reissued for the entire workforce.
And the data does not stay put. LayerX research surfaced by ETHRWorld found that 77% of employees paste data into GenAI prompts, and 82% of those pastes come from personal, unmanaged accounts. Source code, client proposals, PII, roadmap decks, all flowing into models nobody reviewed, through accounts nobody controls. Microsoft draws the useful distinction between the two forms of shadow AI: unsanctioned tools, and unsanctioned agents. CIO frames the same shift as the move from hidden apps to hidden autonomous systems that think, act, and decide. The unsanctioned thing is no longer infrastructure sitting still. It is autonomy taking action on your behalf.
One more beat, because it kills the comforting story that this is a junior developer problem. TrustedTech, citing Censuswide, found that senior decision makers are twice as likely to use unapproved AI as their own reports, 65% versus 31%. The people writing the acceptable use policy are the biggest violators of it. This is not a compliance gap you can train your way out of.
Who Protects What, And Why That Is A Trap
Lay out the responsibility model honestly and the problem becomes visible. IT and network protects the connection: transport, network segmentation, egress. Data and security protects the data: classification, DLP, encryption at rest and in motion. Both of those disciplines are mature and both are doing their jobs.
And nobody protects the business logic. Nobody owns the decisions the agent reasons its way through. I made this case in Rogue AI Agents Aren’t Flukes: an agent does not breach you by cracking TLS or dumping a database. It reasons toward a goal and takes actions, chaining tool calls and crossing a boundary nobody thought to close. No firewall inspects a decision. No DLP rule catches a judgment call.
When every department is quietly running its own agents, that gap stops being a corner case and becomes the whole surface. Security is no longer a team you hand off to at the end of a project. Security becomes everyone’s problem. And here is the trap: the instant a problem belongs to everyone and no single team owns it, it stops being a security problem at all. It becomes a governance problem. That is the line we just crossed.
Govern It The Way We Governed The Cloud
You cannot ban your way out of this. The surveys are unanimous that people will take the risk to hit a deadline, and the BYOAI reality is that when the sanctioned alternative is nonexistent or too slow, employees route around it every time. Blocking lost the first war. It will lose this one faster, because the population routing around you is a hundred times larger.
We won the first war with a platform, so build one again. A sanctioned agent platform where the governed path is the fast path. Google Cloud puts it well in its guidance to counter shadow agents: govern agents with the same rigor you apply to human managed accounts. Inside that platform, the enforcement layer is exactly the checklist I walked through in the agent governance post, so I will not re run it here: identity per agent, least privilege, guardrails, audit, and a tested kill switch. Treat agents like privileged digital workers, and make requesting a governed one easier than pasting a proposal into a personal chatbot. Same move as the landing zone. Same move as the paved road. New vehicle.
But a platform without an owner is just a project waiting to be abandoned. The reason shadow IT actually died is that someone was accountable for the paved road staying better than the ditch beside it, and that ownership cannot live inside security alone. This is where an AI Center of Excellence earns its name. Not a committee that meets once a quarter to rubber stamp tools, but a standing cross functional body with real authority: leaders from the business units who know what work people are actually trying to get done, HR who owns acceptable use and the human consequences of getting it wrong, IT who owns the platform and the connection, and security who owns the data and the containment. Put those four in a room with a shared mandate and you get a governance framework built around how people actually work. Leave any of them out and you get a framework built around how one function wishes people worked, which is exactly the framework everyone quietly ignores.
That distinction is the whole game. A CoE that optimizes for control writes rules that make the governed path slower than the shadow one, and users respond the only rational way they can, by going around it. A CoE that optimizes for enablement makes the sanctioned path genuinely faster and safer, and the shadow behavior loses its reason to exist. The framework has to work for the user, or the user will go their own way instead of taking the paved road. That is not a soft nicety. It is the entire mechanism by which the last decade of shadow IT was actually resolved. If you want the operating model, org structure, and staffing patterns for standing one up, AWS Prescriptive Guidance has a solid guide to building a Cloud Center of Excellence, and Atlan has a practical charter and roles playbook aimed specifically at agent governance. I am not going to turn this post into a how to build one. I only want you to walk away convinced that you need it, and that it cannot be security holding the pen alone.
The Takeaway
Shadow IT taught us the lesson once, and it was expensive. Regulation and blocking lost. Platforms and paved roads won. Shadow GenAI is the identical fight with the population expanded to your entire company and the clock running faster.
- Stop writing the ban. It did not work in 2009 and it will not work now.
- Name an owner for the business logic, because right now nobody has it.
- Stand up an AI Center of Excellence with BU, HR, IT, and security at the table, and give it the mandate to build the governance framework.
- Build the sanctioned agent platform before the ungoverned one becomes load bearing.
- Make the governed path the fast path, or your best people will keep swiping their own cards.
- Reuse the muscle you already have. Your platform team beat shadow IT. Point them at agents.
I was shadow IT once. It was the right instinct pointed at the wrong path, and the fix was never to punish the instinct. The fix was to build somewhere better to point it. The orgs that win the next eighteen months will be the ones who hand employees a governed agent platform before the ungoverned one becomes the thing everything quietly runs on. Build the road. They are already driving.
