Four out of five AI tools operate without IT supervision, points to research

A new research exposes a worrying blind spot in companies: 80% of the AI tools in use pass away from the IT area supervision. In small and medium businesses, the average reaches 414 unauthorized tools for every 1,000 employees. With the proliferation of autonomous agents, experts warn of increasing security and governance risks.

The survey, published by Infosecurity Magazine, reinforces the phenomenon known as shadow AI: teams adopt artificial intelligence solutions on their own, without going through IT evaluation, approval or monitoring. For organizations, the problem is not only technical — it is strategic.

IT Supervision in AI: Why does the lack worry?

When an AI tool does not go through IT radar, no one knows exactly what data it processes, where it stores, or how it is trained. This makes room for leaking sensitive information, violation of LGPD and even misuse by third parties. The risk is more acute in the context of AI agents, which are not limited to answering questions: they perform tasks and make decisions automatically.

The research shows that governance is not following the pace of adoption. While most companies have policies for traditional software, AI tools often stay out of approval flows.

IT Supervision in AI: How many unauthorized tools are there?

The study calculates an average of 414 unauthorised AI tools by 1,000 employees in SMBs. This volume indicates that the adoption of AI in companies is being pulled by their own employees — not by the technology department. The result is a fragmented ecosystem with multiple overlapping solutions, duplicate data and larger attack surfaces.

In larger organizations, the scale tends to be even more complex, because each team can choose their own tool without standardization.

IT Supervision in AI: How do tools get out of hand?

The path is simple and common: an employee creates a free account, installs a browser extension or uses a trial version to speed up the work. Without a clear policy, adoption happens naturally and no one communicates to IT. Over time, these tools access client bases, financial spreadsheets and corporate emails.

The problem expands with AI agents. Unlike a simple chatbot, an agent can interact with other systems, change records and automate entire flows — without visibility or audit trail.

IT Supervision in AI: What should companies do now?

The first step is visibility: mapping all AI tools in use, authorized or not. Then create usage policies, safety assessment criteria and continuous approval processes. It is also essential to monitor agents and integrations as if they were privileged accounts.

As the persistent AI cyber attacks" show are the new threat, OpenAI's leading alert, the threat is not only in the tools, but in the way they are used and protected. The same reasoning applies to any Brazilian company that already adopts AI on a daily basis.

The conclusion of the research is direct: technology is advancing faster than governance. Without IT supervision, each new AI tool is an additional door to security incidents — and companies that ignore this will pay dearly.

IT Supervision in AI: Frequently Asked Questions

What's an unsupervised AI tool?

It is any AI solution used within the company without the IT area having evaluated or approved its adoption. This includes chatbots and browser extensions to autonomous agents integrated into internal systems.

Why are small and medium-sized enterprises most affected?

In SMBs, IT teams are usually lean and employees are more free to choose tools. The survey found an average of 414 unauthorized tools by 1,000 employees in this type of company.

How to reduce the risk of shadow AI?

It is necessary to map the tools in use, define clear adoption policies, integrate AI with IT security flows and continuously monitor agent behavior and integrations. Team training also helps transform unauthorized use into safe adoption.