Understanding Shadow IT in the Age of AI

## Executive Summary This report explains the concept of "shadow AI"—employees using personal or unapproved AI services and local models for work—and outlines the resulting risks such as data exposure, credential theft, malware hidden in models, adversarial/model-poisoning attacks, and compliance violations; it also recommends mitigation steps including user education, approved tool management, network monitoring, security assessments, and a zero-trust approach.