The danger of Shadow AI: how lack of governance affects companies

It was Thursday, 5:40 PM, and Marina needed to deliver the price adjustment proposal by the end of the day. The spreadsheet had 3,200 lines: clients, contracts, margins, negotiated discounts. Doing the analysis by hand would take all night.
Cybersecurity 5 min read By: Skyone

The spreadsheet that went out the window: Shadow AI and the risk of AI without governance

It was Thursday, 5:40 PM, and Marina needed to deliver the price adjustment proposal by the end of the day. The spreadsheet had 3,200 lines: clients, contracts, margins, negotiated discounts. Doing the analysis by hand would take all night.

She opened a browser tab, logged into an AI tool with her personal account, copied the entire spreadsheet, and wrote: "Analyze this data and suggest adjustments per client."

In four minutes, she had the answer. At 6 p.m., she handed in the work and was praised by her manager. No one asked how she had done it.

(Marina is a fictional character, inspired by situations described in the research.)

None of this was done in bad faith. It was haste, tools at hand, and no visible rules. But the profit margin for each of the company's clients just spiraled out of control. This story has a name: Shadow AI.

Shadow AI is the use of AI tools without the knowledge or approval of IT and security. In the Panorama Vibe Coding Brasil survey, 50.1% of professionals have already created automations or integrations without a formal IT project, but only 26.4% (524 out of 1,982) confirm having clear and formalized rules about what data can enter AI tools.

Is Marina an exception? The numbers say no

The Panorama Vibe Coding Brasilstudy, conducted by Skyone in partnership with The News, surveyed 2,440 professionals.

IndicatorResult
They created automation, applications, or integrations without a formal IT project50,1%
Of the total user base, who did this in the last 6 months?43,1%
They have clear and formalized rules about data in AI26,4%
Creators who spontaneously express concern about leakage (those who create more than one type of solution)27,3%

The numbers together say it all: breeding has accelerated, and the rules haven't kept pace. And there's a key detail: breeders already feel the risk, they just haven't received the protection.

When the rule doesn't exist, or exists and nobody sees it

The most common profile in the survey, representing 42.7% of the sample (846 responses), is that of "fragmented orientation": a lot of technical activity, without a standard. Among the creators of this group:

  • 52,1% They create automations;
  • 49,5% They develop internal integrations;
  • 60,9% They have no clear guidelines regarding data.

Even among companies that have rules, 33.1% say that they are poorly communicated.

Why banning doesn't solve anything

If Marina's manager had banned AI, she would have submitted the proposal later on Friday, or she would have used her cell phone. The problem that led her to the tool would still be there. The report summarizes the dilemma: compliance needs to come before free experimentation, without killing experimentation.

What if Marina's Thursday were different?

Imagine the same scene, 5:40 PM, the same spreadsheet. The difference is that, instead of a personal account, Marina opens the company's unified AI portal.

She makes the same request and receives a response in four minutes. But behind the scenes, three things happen without her having to think about them:

  1. Sensitive names and values ​​are anonymized before reaching the model in the public cloud.
  2. The request is monitored, and the command is logged.
  3. Access is controlled: the company decides which models are allowed.

This is the role of an enterprise AI Gateway, and it's what Skyone Astro (coming soon) is designed to do: a single portal for accessing multiple LLMs, such as OpenAI, Gemini, and others, with monitoring, sensitive data anonymization (DLP), and command logging. Marina continues to move quickly, and the company remains in control.

From rule to practice: how Skyone helps

Study challengeGivenSkyone Solution
Sensitive data without rules26.4% have rulesSkyone Astro: AI Gateway with DLP, monitoring and logging.
Non-standard integrations and automations60.9% without data guidelines (fragmented group)Skyone Studio: iPaaS, lakehouse, and orchestration with governance from the source.
Rules that nobody knows or applies33.1% say the rules are poorly communicatedBuilders by Skyone: practical education that teaches you how to build within the rules.

A traffic light to start now

Until the tool is available, a one-page rule can help:

ColorData typeGuidance
🟢Public or already anonymized informationCan be used in approved tools
🟡Internal data without identifying customers or individualsOnly in approved enterprise tools
🔴Personal data, contracts, margins, credentials, source codeNever use outdoor tools without protection

Frequently Asked Questions

What is Shadow AI?
It's the use of AI tools by employees without approval or knowledge from IT and security.

What are the risks?
Leaks of corporate and personal data, loss of traceability, non-compliance with the LGPD (Brazilian General Data Protection Law), and automation without an owner.

What is Skyone Astro?
It's Skyone's enterprise AI Gateway: a single portal for accessing multiple LLMs, with request monitoring, sensitive data anonymization (DLP), and command logging. The product is in the launch phase.

What is the difference between an AI Gateway and a usage policy?
The policy dictates what can and cannot be done. The gateway applies protection along the way, even when someone forgets the rule.

Returning to Thursday, 5:40 PM

Your company's Marina doesn't need to be constantly on guard, because the system can be part of that care. The closing sentence of the Panorama sums it up well: the coding vibe is already happening. Now it's time to govern.

If you can do one thing this week, share the traffic light system with your team. And if you want to understand the full picture, download the Panorama Vibe Coding Brasil or learn about Skyone's AI and data solutions.

Skyone
Written by Skyone

Start Your Digital Transformation Today

Transform Your Business with Skyone. Request a demo or schedule a call with our experts to discover how Skyone can accelerate your digital strategy.

Subscribe to our newsletter

Stay up to date with Skyone content

Contact Sales

Have a question? Talk to a specialist and get all your questions about the platform answered.