The control failure is not a rogue model. It is employees giving personal AI tools access to internal messages, HR data, and confidential documents while leaders think the policy is clear. Once that access is granted by the user, sensitive data can leave through a trusted-looking workflow instead of a malware event.
Okta’s survey found that more than half of employees use unapproved AI tools, and 58% of executives said their organization had an AI-related incident or close call last year. It also found a gap between leadership and staff: executives believe the rules are clear, while more than half of employees say the policies are unclear, hard to find, or missing.
That gap keeps shadow AI inside the business even when tools are banned. The risk is quiet exfiltration through productivity workflows that normal blocking and DLP assumptions do not see.