Lyro Shadow AI Report: $670,000 More per Breach for the AI No One Approved
The $670,000 shadow AI premium
Employees adopted AI before employers
Where bots alone fall short
New report draws on 45 published sources to show why the alternative to a deliberate AI program is not the absence of AI, but ungoverned AI.
If your people are already using AI without approval, then 'doing nothing' is not a neutral choice: it’s a choice to keep the risk and forgo the upside.”
SAN FRANCISCO, CA, UNITED STATES, September 11, 2026 /EINPresswire.com/ -- Organizations with high levels of shadow AI paid an average of $670,000 more per data breach than organizations with little or none, according to IBM's Cost of a Data Breach Report 2025. A field study of 5,172 customer-support agents, published in the Quarterly Journal of Economics, found that access to an AI assistant raised issues resolved per hour by 15% on average, with gains of about 34% for the least-experienced, lowest-skilled workers. Together, the findings illustrate the choice examined in "Shadow AI. From Hidden Habit to Deliberate Strategy," a briefing published by Lyro drawing on 45 published sources.— Tytus Gołas, Co-founder and CEO of Tidio
The status quo is not the absence of AI. It is ungoverned AI. MIT's 2025 NANDA study found that employees at more than 90% of firms use personal AI tools for work, while only about 40% of companies hold an official AI subscription. Microsoft's 2024 Work Trend Index, covering 31,000 people across 31 countries, found generative-AI use among knowledge workers at 75%, with 78% of those users bringing their own tools. Software AG's study of 6,000 knowledge workers concluded that half of all employees are shadow AI users.
Company data travels with those tools. Cyberhaven's analysis found that 27.4% of the corporate data employees put into AI tools by March 2024 was sensitive, up from 10.7% a year earlier, while the total volume of corporate data flowing into those tools rose 485% year over year.
The governance layer has not kept pace. IBM found that one in five breached organizations was compromised through shadow AI, that 63% either had no AI governance policy or were still developing one, and that 97% of organizations suffering AI-related security incidents lacked proper AI access controls. The KPMG–University of Melbourne global study of 48,340 people across 47 countries found that only 40% of employees say their workplace has a policy on generative-AI use, and only 47% have received AI training.
The potential upside sits on the same balance sheet. PwC's 2025 analysis of close to a billion job postings linked AI-exposed industries to nearly four times the productivity growth and roughly three times the revenue-per-employee growth of less-exposed sectors.
"If your people are already using AI without approval, then 'doing nothing' is not a neutral choice: it's a choice to keep the risk and forgo the upside," wrote Tytus Gołas, Co-founder and CEO of Tidio, in the report's preface.
Blanket prohibition alone is unlikely to close the gap. Software AG found that 46% of workers would refuse to stop using personal AI tools even if their employer banned them outright. Netskope's telemetry points to an alternative approach: when employees receive a real-time warning that they are about to send sensitive data to an unapproved tool, they decline to proceed 73% of the time. Netskope also observed personal-account generative-AI use fall by 12 percentage points in three months as organizations rolled out approved alternatives.
Customer service is one of the workflows the report recommends sanctioning first: it combines high volume, clear metrics, and strong field evidence of productivity gains. Contentsquare's analysis of 22 million customer-service conversations found human-plus-bot resolution reaching 57%, compared with 29% for bots alone. Bot-only performance was weakest in more complex categories, including refunds at 18%, technical issues at 15%, and security problems at 14%.
While these datasets are not directly comparable, Tidio's own platform data shows Lyro averaging a 72% resolution rate across its clients.
Regulation further raises the cost of leaving AI use unmanaged. The EU AI Act provides for penalties of up to €35 million or 7% of global annual turnover for prohibited practices, while obligations for high-risk AI systems are being phased in under the Act's evolving implementation timetable.
"The recurring answer is the same at every stage: meet the demand deliberately, keep scope narrow, and enforce your guardrails by design rather than by hope," writes Tytus Gołas.
The full report is available at https://www.getlyro.ai/reports/shadow-ai
For media inquiries, visit https://tid.io/newsroom
About Tidio
Tidio is an AI-powered customer service platform that helps businesses manage and automate customer conversations. Its Lyro AI Agent resolves customer inquiries automatically and escalates more complex cases to human operators.
https://www.tidio.com
About Lyro
Lyro is Tidio's AI agent for customer service, designed for e-commerce, SaaS, and service businesses. Across Tidio's client base, Lyro averages a 72% resolution rate, automating routine customer conversations while allowing human teams to focus on more complex cases.
https://www.getlyro.ai
Roberta Raczyńska
Tidio
pr@pr-tidio.net
Visit us on social media:
LinkedIn
Instagram
Facebook
YouTube
TikTok
X
Other
Meet Lyro, Tidio's AI agent for customer service
Legal Disclaimer:
EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.
