Field Note
Bring Your Shadow AI Into the Light
Half your team is already using AI to do their jobs. Most of them haven’t told you. They didn’t wait for permission — they went to the closet. That’s not a discipline problem. It’s the gap, and it’s costing you twice.
At home they use whatever works; at the office the good stuff is off-limits — so the people who’ve felt what AI can do route around the rules. A YC partner named this home-versus-work gap on the Lightcone podcast, but it doesn’t sit still: it goes underground. Over half of workers now hide their AI use and pass the work off as their own.
That costs you twice. First, the risk you can’t see: nearly half of workers admit to putting sensitive company data — customer records, internal docs, employee data — into public AI tools, and a breach that starts in shadow AI runs about $670,000 costlier. You cannot govern what you cannot see.
Second, the capability you’re not capturing. Every closet user is quietly fixing their own friction — an hour saved here, a task automated there — and none of it aggregates, because it’s off the books. It’s worst at smaller companies, where unofficial use runs highest.
The reflex is to clamp down: no unapproved AI, use only the sanctioned model, one narrow lane. But restriction doesn’t close the gap — it deepens it. A crackdown just pushes your most motivated people deeper into the closet.
Do the opposite. Bring them into the light — because the people already doing it are your R&D. You don’t hand them a policy; you take what they built in the closet, turn it into a skill everyone can use, and spread it — one person’s fix becomes the whole team’s in a week.
Leadership’s job shifts from originating to governing and spreading — and to owning what comes out. This isn’t turning everyone loose; accountability stays at the top. When something breaks, you don’t crack down — you fix the skill once, and because it’s shared, it reaches everyone at once. Empowerment, with someone still holding the bag. That’s readiness — the outcome of eight dimensions, not one of them: doctrine, organization, training, leadership, people, facilities, policy — and the tool everybody buys first.
This is one thread in a book I’m writing on running AI like a readiness problem, not a purchase.
Which of the eight have you actually built? Take the one-page readiness self-audit — it scores all eight against your own shop.
Sources: concealment (57%) + sensitive-data entry (48%) — KPMG × University of Melbourne, “Trust in AI” (2025). SMB “bring-your-own-AI” (80%) — Microsoft × LinkedIn Work Trend Index (2024). Shadow-AI breach cost (+$670K) — IBM, Cost of a Data Breach (2025). Home/work gap — Y Combinator, “The Lightcone” (Pete Koomen). Readiness: the U.S. military’s eight-dimension model, DOTMLPF-P.