ValorC3 Data Centers is a North American regional data center owner and operator that delivers the full enterprise IT stack, colocation, cloud, and connectivity across high-growth, secondary markets. ValorC3 serves mid-market enterprises, such as banks, credit unions, regional healthcare systems, manufacturers, and technology firms, at densities up to 30kW. The company also serves wholesale customers that want entire data halls built to suit their exact specifications. This includes greenfield and brownfield projects and retrofits of existing structures, including industrial sites with stranded power.
A financial analyst uploads a signed vendor contract to a free AI tool to summarize the payment terms before a Friday deadline. No one asked permission first, so by the time IT finds out, if it finds out at all, that sensitive contract data has already left the building and is sitting on servers no one in the organization controls. This kind of exchange is playing out across finance, HR and clinical departments right now, and it echoes something we lived through a decade ago.
We called it Shadow IT: employees turned to tools they could access quickly and use with less friction than the approved solutions, and in some cases, they even expensed those tools because they were easier to get the job done with.
Shadow AI is the same instinct, wearing a better interface, moving on a faster clock and carrying a much wider blast radius. People will almost always trade a little security for a lot of convenience, and the only part that’s changed is how easy the trade has become.
The Same Low Barrier, Higher Stakes
The barrier to entry is what connects Shadow IT and Shadow AI. In both cases, employees are not usually trying to bypass the business; they are trying to get work done with tools that are easier to access, faster to use, and less cumbersome than the approved path. The difference is that Shadow AI raises the stakes. A simple browser tab and a prompt can now expose sensitive data, create unreliable outputs or influence important business decisions before IT, security or leadership even knows the tool is being used.
Adoption is outrunning governance almost everywhere: according to Microsoft and LinkedIn’s Work Trend Index, 78% of people who use AI at work say they’re bringing their own AI tools to the job, accounts IT never provisioned, running on infrastructure IT never vetted, and 52% say they’re reluctant to admit using AI for their most important tasks. That second number matters most, because it means most of an organization’s real AI use is happening somewhere leadership can’t see it.
Compliance hasn’t caught up either. While some frameworks are starting to address AI directly (e.g., ISO/IEC 42001 specifically calls out AI management systems), others such as SOC 2 and ISO 27001 still don’t spell out AI-specific controls the way they do for access management or change control. Where there’s no clear rule, people default to what works, and once someone finds an assistant they genuinely like, an unfamiliar internal tool feels like a downgrade. This makes the problem a change management issue as much as a security one, and it needs to be treated that way.
The Next Bill Shock Is Already Here
The public cloud land rush produced bill shock, and bill shock produced an entire cloud cost management industry almost overnight. Token-based AI pricing is running the same script. Consumption is unpredictable, and plenty of organizations have already been surprised when per-user pricing shifted underneath them mid-contract. We raced to the public cloud, then spent a decade building an industry just to manage what it cost us. There’s no reason to believe AI plays out differently.
Just as cloud repatriation pushed workloads back to private and hybrid infrastructure once the bills came due, expect a similar move toward private models running on infrastructure that organizations control themselves, for both data protection and cost predictability.
Where Security, Compliance and Convenience Collide
Regulated industries are where abstract risk turns into a legal one. Healthcare is the clearest example: AI is genuinely useful for transcription, chart review and symptom correlation, but each of those use cases involves protected health information. New liability questions are forming in real time, and when a physician’s judgment and an AI recommendation diverge, who’s accountable doesn’t have a settled answer yet.
The value of AI tools is real, and it’s exactly why banning them fails outright. The real task for most IT leaders is putting that value inside a boundary the organization controls, rather than trying to stop the use case altogether.
Four Moves That Get Organizations Ahead
The organizations pulling ahead on this share four moves in common.
- Put shadow AI on the risk register. Formally, with a named owner. If AI use isn’t tracked as a documented risk, nothing else on this list gets funded.
- Enable before you restrict. Give people a sanctioned tool good enough to compete with the free option. Restriction without a credible alternative rarely reduces usage; more often it just pushes activity underground and out of sight.
- Train the way you train for phishing. Recurring, scenario-based and measured, until “don’t paste that into a public model” is as automatic as not clicking a suspicious link.
- Write the policy, then keep rewriting it. AI policy written once and left alone is obsolete within a quarter or two, so the review cadence gets built in from day one rather than treated as an afterthought.
For the most sensitive workloads, where the model actually runs matters just as much: a private model on infrastructure an organization controls solves the data exposure and cost variability problems in one move.
Governance Is a Competitive Advantage, Not a Brake
Shadow IT never truly went away. We learned to see it, govern it and absorb the parts of it that were genuinely useful, and shadow AI will likely follow the same arc on a shorter timeline. The only real question is whether leadership decides to see it now, on their own terms, or discovers it during an audit, on someone else’s. Strong governance is what lets an organization move quickly here, catching gaps in a controlled review rather than a surprise audit.
Related News:
Darktrace Signal Labs: Researching Emerging Risks of Enterprise AI Agents
ValorC3 Debuts Disaster Recovery Platform for Hypervisor Freedom
