A falling shadow AI rate can hide a growing problem, and a scary one can be mostly noise. Spark data shows four ways shadow AI metrics mislead, and how to read them correctly.
The Short Answer
A single shadow AI number can mislead in four ways: rate vs. reach, averages hiding departments, tool counts vs. usage, and desktop misclassification. In one Larridin customer, the unapproved usage rate fell from 8.17% to 6.2% while the share of daily users touching unapproved tools rose from 9.61% to 21.2%. Compare usage rate, daily-user reach, department-level patterns, and tool classifications before drawing conclusions.
Key Wins
What’s a Spark Insight?
A Spark Insight is a data-backed finding Larridin surfaces automatically from how your teams actually use AI, flagging the patterns worth a leadership conversation.
Who This Matters To
CIO · CISO · CAIO
| If you’re asking… | The answer | Go deeper |
|---|---|---|
| Can shadow AI grow while the rate goes down? | Yes. In one org, the unapproved usage rate fell from 8.17% to 6.2% while the share of daily users touching unapproved tools more than doubled, to 21.2%. | Rate vs. reach |
| Does an org-wide shadow AI rate tell the whole story? | No. In one org, the overall rate was 5.9%, while 100% of tracked AI interactions in one department involved tools classified as unapproved. | Averages hide departments |
| Is a high count of unapproved tools a problem? | Not on its own. In one org, 87% of detected AI tools were classified as unapproved, but they accounted for just 7% of AI interactions. | Tools vs. usage |
| Why do approved tools show up as unapproved? | Desktop clients of approved tools are often classified as unapproved, which can inflate shadow AI numbers. | The desktop quirk |
Shadow AI dashboards usually lead with one number. That number can move in the wrong direction for the right reasons, or the right direction for the wrong ones. Reading it well takes a few companion metrics.
| What you’re struggling with | What you actually need | How Larridin helps | Proof from Spark data |
|---|---|---|---|
| “Our shadow AI rate is falling, so we’re fine.” | Reach as well as rate | Tracks unapproved usage rate and unapproved daily-user share together | |
| “Our org-wide rate is low.” | Department-level views | Breaks unapproved usage down by department | One org: 5.9% org-wide; 100% of AI interactions flagged in one department |
| “Most of our AI tools are unapproved.” | Usage weighting, not just tool counts | Shows usage share alongside tool counts | One org: 87% of tools classified as unapproved, but 7% of AI interactions |
| “The top unapproved tools look like approved ones.” | Client-level detail | Separates desktop clients from other access methods | One org: top “unapproved” tools were all desktop clients |
The question you’re asked: “Is shadow AI getting better or worse?”
What to do: Report usage rate and daily-user reach together. If the usage rate falls while daily-user reach rises, investigate the difference before concluding shadow AI is declining.
For more on enterprise-wide AI visibility, see AI Monitoring for CIOs.
The question you’re asked: “Where should I focus our shadow AI review?”
What to do: Start with department-level outliers and tools with real usage, not the longest list of unapproved tools.
For more on governance visibility, see AI Monitoring for CISOs.
The question you’re asked: “Should we approve more tools?”
What to do: Look at which unapproved tools have real usage. Those are your candidates for review, not the long tail.
For more on monitoring AI programs and risk, see AI Monitoring for CAIOs.
When the share of daily AI users touching unapproved tools rises even as unapproved tools account for a smaller share of total AI activity.
The usage rate measures what share of activity is unapproved. Reach measures the share of daily AI users touching unapproved tools. In one Larridin customer, the rate fell from 8.17% to 6.2% while reach rose from 9.61% to 21.2%. The headline improved.
Myth: A falling shadow AI rate means less risk.
Reality: In one organization, the usage rate fell even as the share of daily AI users touching unapproved tools more than doubled.
Departments with very different behavior.
In one org, the overall unapproved rate was 5.9%, while one department was at 100%. Averages smooth those outliers away. Department-level views show where flagged activity is concentrated, so teams can investigate before treating it as a policy violation.
Because tool counts ignore usage, and desktop clients of approved tools are often misclassified.
In one org, 87% of detected AI tools were classified as unapproved, but those tools accounted for just 7% of AI activity. In another, the top tools flagged as unapproved were all desktop apps. Some may have been approved tools accessed through a different client, so check the classifications before treating the activity as shadow AI.
Spark callout: One desktop coding client classified as unapproved had just 5 users but 1,463 events. A handful of heavy users can dominate the numbers.
There isn’t one. Compare usage rate, daily-user reach, department patterns, and tool-level activity. Then verify what the flagged tools actually are.
Desktop clients can be identified differently from the web or enterprise versions of the same tool, so an approved tool may appear as unapproved.
Review monthly and investigate sudden department-level changes. In one organization, Sales' unapproved usage rate increased 139.67% over four weeks.
See rate, reach, and department-level shadow AI in your org, and bring them to your next security review.