Shadow
Work that left the stack, and why it left
Unapproved tool use recorded as a routing failure rather than a policy violation. Every event here started as a real task that the licensed stack turned away or disappointed.
Demo workspace — synthetic organisation. Not measured telemetry.
Recorded events
23
Last 90 days
Caused by a gap you created
30%
No licensed tool, or blocked by policy
Involving sensitive material
13
Confidential or personal data
Read that middle number first. When most unapproved use traces to a gap the organisation created, the remedy is a purchase or a policy change — not a warning email. Blocking the tool without closing the gap removes the workaround and leaves the task.
Where it leaks
Repeatable processes7mostly ChatGPT (personal account)5 sensitive
Writing and documents4mostly A browser extension2 sensitive
External research3mostly Gemini (personal account)2 sensitive
Email and inbox2mostly A browser extension2 sensitive
Presentations2mostly A browser extensionPreference
Code1mostly A browser extensionPreference
Spreadsheets and analysis1mostly ChatGPT (personal account)Preference
Finding things1mostly Claude (personal account)1 sensitive
Long document analysis1mostly Claude (personal account)Preference
Meetings1mostly A browser extension1 sensitive
A browser extension
8
ChatGPT (personal account)
8
Claude (personal account)
3
Gemini (personal account)
2
Perplexity (personal)
2