Every enterprise has a data egress point it never provisioned, never logged, and cannot see: the prompt box. Employees paste in a contract to summarize, a stack trace to debug, a customer list to reformat. The text leaves your network, crosses a provider boundary, and lands in an inference pipeline you don’t control. Nobody filed a ticket. Nobody flagged it as an outbound transfer. It just happened, thousands of times a day, and it is happening right now while you read this.

This is shadow AI, and the numbers have moved past the “emerging risk” phase.

The exposure is measured, not hypothetical

Adoption is effectively universal. 78% of organizations reported using AI in 2024, up from 55% the year before . Sanctioned or not, the tools are already inside. 69% of organizations have evidence or suspect employees are using public generative AI at work . And “suspect” is the operative word, because most have no way to confirm it.

The employees themselves are more candid than the telemetry. 38% of employees who use AI admit they have submitted sensitive work information to AI tools without their employer knowing , a figure that climbs to 46% among Gen Z. These are the ones willing to say so on a survey. The real rate is higher.

And it is now showing up in breach data. IBM found that shadow AI was a factor in one in five breaches, and organizations with high levels of shadow AI paid an average of $670,000 more per breach . This is no longer a governance abstraction. It is a line item.

What actually leaves the building

The concern is not that employees use AI. It is what rides along in the prompt. When a shadow-AI incident occurs, it is disproportionately your most sensitive data that moves. In IBM’s data, shadow-AI incidents compromised customer PII in 65% of cases and intellectual property in 40% , both above the global breach averages of 53% and 33%.

This maps cleanly to the risk frameworks your auditors already read. OWASP ranks Sensitive Information Disclosure (PII, credentials, source code, and confidential business data leaking through LLM interactions) as LLM02:2025 , near the top of its list for LLM applications. NIST’s Generative AI Profile names Data Privacy and Information Security among its core GenAI risk categories . The standards bodies have already named the failure mode. Most enterprises just have no instrument pointed at it.

The categories of data that leak through a prompt look familiar to any security team:

  • Regulated data: customer PII, health records, financial details that trigger disclosure obligations the moment they cross a boundary.
  • Credentials and secrets: API keys and tokens pasted into a debugging prompt, now sitting in a third party’s logs.
  • Source code and IP: proprietary logic handed over for a quick refactor.
  • Confidential business context: deal terms, roadmaps, internal strategy, offered up as “context” for a better answer.

Why the usual controls miss it

Your existing egress stack was built for a different shape of traffic. DLP watches file uploads, email, and known SaaS connectors. A CASB governs sanctioned apps. None of them were designed to reason about a paragraph of natural language flowing to an API endpoint that looks, on the wire, like any other HTTPS call. The payload is unstructured, the destination is a legitimate model provider, and the transfer is indistinguishable from ordinary use.

The governance gap is the tell. Among organizations breached through an AI model or application, 97% lacked proper AI access controls, and 63% either had no AI governance policy or were still developing one . The policy vacuum is not negligence: it is the absence of a place to enforce policy. You cannot govern a flow you cannot see or intercept.

Blocking is not the answer either. Ban the sanctioned tools and usage moves to personal accounts and phones, where you have no visibility at all. The productivity gains are real, and employees will not give them up. Gartner’s projection assumes exactly this trajectory: by 2030, more than 40% of organizations will suffer security and compliance incidents caused by unauthorized AI tools . The trend line goes up because the underlying incentive (faster work) never reverses.

What good looks like

The workable model is the one enterprises already apply to every other class of egress: put a control point at the boundary and make the traffic legible. For AI, that boundary is the path between your applications, agents, and employees and the model providers they call.

At that layer, a few properties matter:

  • Visibility. Every prompt and completion is inspectable traffic, not an invisible side channel. You know what leaves, to which provider, containing what.
  • Enforcement. Sensitive data can be caught and stopped before it crosses the boundary, not reconstructed from an incident report afterward.
  • Neutrality. The control sits in front of whichever providers you use, so policy is uniform whether the call goes to one vendor or five.
  • Non-disruption. It rides transparently on existing traffic, so security does not come at the cost of the productivity that drove adoption in the first place.

This is the role Milgram is built for: a transparent firewall at the AI traffic boundary, giving you a single control plane over what your prompts actually send out, without forcing you to choose between using AI and governing it.

Your employees’ prompts are already leaving the building. The only open question is whether you can see them when they do: milgram.dev .