The ShadowAI Map™
Employees are already using AI in your business. This framework surfaces what's happening beneath the surface, assesses your real risk exposure, and turns informal use into policy advantage.
The Hyper7 Position
Shadow AI is your people doing free R&D on your behalf. The only winning move is bringing it into daylight.
Where does your organisation sit?
Two axes. Four positions. Every SME lands somewhere on this map.
High awareness · Restrictive
Lockdown
You can see what's happening but you're strangling it. Value leaks to competitors who enable.
▶ Target state
High awareness · Enabling
Daylight
Visible, governed, and enabled. Shadow use becomes shared capability. This is the destination.
Low awareness · Restrictive
Blackout
AI is happening but invisible. The ban exists; usage continues underground. Risk is unmanaged.
Low awareness · Enabling
Wildfire
You've said yes but aren't watching. AI is spreading fast with no guardrails. Good intent, growing exposure.
The mental models that change how you see this
Each one challenges a comfortable assumption.
The ban doesn't work
It doesn't stop usage — it stops visibility. You lose the ability to manage what you can no longer see.
Shadow AI is a signal, not a scandal
Employees using unauthorised AI are telling you they see value your processes aren't delivering.
The risk isn't the tool — it's the data going into it
Client contracts pasted into personal accounts is your actual exposure, not the model itself.
Culture determines whether good practice spreads or hides
If your best AI user would hide a five-hour gain to avoid scrutiny, your culture is destroying value.
One policy enforced visibly beats ten nobody reads
No client data into personal AI accounts. Simple, memorable, auditable.
Key-person dependency is the hidden risk
Workflows living in one person's head look like productivity — until that person resigns.
Daylight is the destination, not a risk to manage
The goal isn't zero shadow AI. It's visible AI — a culture where good practice compounds.
Not a quiz. Not a scorecard.
Honest answers to each one will tell you more than any audit.
Q1
What would surprise you if you ran a ten-minute show-and-tell tomorrow?
Q2
Where is the gap between your policy and your reality?
Q3
What data have you already lost visibility of?
Q4
Who is your most AI-fluent person, and what walks out the door if they leave?
Q5
Does your culture reward people for showing you good AI use, or punish them?
Q6
What would it take to make the safe option the easy option?
Q7
What would Daylight look like in your business, specifically?
Take this thinking away with you
The full Shadow AI Map — insights, framework diagram, reflective questions, and seven research pointers — as a PDF you'll actually keep.
- 7 insights that reframe the problem
- The full 2x2 framework diagram
- 7 reflective questions to sit with
- 7 research pointers to go deeper
No pitch decks. No follow-up sequences. Just the framework — and a note from Bern.