Lenovo Report Finds Shadow AI Use Outpaces Enterprise Oversight
Summary
Lenovo’s survey of 6,000 enterprise employees found 20–33% use AI outside IT oversight. The report links tooling and training gaps to risks including sensitive-data exposure and compliance failures, and recommends governance, in-context training and standardized tools.
Key points
- Lenovo’s global survey of 6,000 full-time enterprise employees found that 20–33% use AI outside IT oversight.
- Seven in ten respondents use AI tools at least several times a week, and 80% expect their use to increase over the next year.
- The report identifies insufficient tools and inconsistent training as drivers of unsanctioned AI use; half of employees say better training would help them get more value from workplace AI.
- Lenovo warns that unmanaged AI use may expose intellectual property or sensitive data outside governed environments and fragment workflows.
- Seventy-four percent say more or better training on AI-related cybersecurity risks would reassure them; 73% cite reassurance from knowing their company’s security team uses AI, and 70% cite stricter AI-use policies.
- The report recommends establishing governance before scaling AI, providing continuous in-context security learning, and standardizing AI interfaces.
Article Details
- Publisher
- Help Net Security
- Report Period
- 2026
- Scope
- Global employee use of AI outside IT governance and related cybersecurity concerns.
- Sample Size
- 6,000 full-time employees at enterprise organizations globally.
- Key Statistics
- An estimated 20–33% of workers use AI outside IT oversight.
- Nearly half of employees are highly concerned about criminals using AI for attacks against their company and about accidental sensitive-data leakage through public AI systems.
- 40% are highly concerned about deepfake videos and AI-generated phishing emails.
- 23% are highly concerned about criminals directly attacking their company’s AI systems.
- In separate Lenovo CIO Playbook findings, 61% of IT leaders say AI is increasing cybersecurity risks, while 31% are confident in their ability to address those risks.
- Recommendations
- Build governance before scaling AI.
- Embed security awareness into work through continuous, in-context learning.
- Standardize the AI interface across workflows and endpoints.