Security leaders lose visibility as consultants deploy shadow AI copilots to stay employed

Consulting firms’ accelerating adoption of generative AI to automate knowledge work is sending shockwaves across the industry, triggering workforce shakeups and layoffs.Employees increasingly perceive AI agents as existential threats, fueling anxiety and driving many to build shadow AI apps to preserve their relevance defensively.

This month, PwC cut roughly 2% of its U.S. staff, approximately 1,500 jobs, in audit and tax lines. EY eliminated 150 roles even as it announced a $1.4 billion investment to build an enterprise AI platform. Accenture slashed 19,000 positions (2.5% of its workforce) amid slowing growth and rising tech costs in 2023.

McKinsey & Company is reportedly paying senior staff up to nine months’ salary to quit voluntarily, a strategy industry observers link to a downturn in consulting spending accelerated by AI-driven change.

KPMG is realigning skills as AI platforms replace parts of the audit process and other routine tasks. In November of last year, 333 jobs were cut, or approximately 4% of U.S. audit employees.

This escalating wave of AI-driven layoffs is reflected in IBM CEO Arvind Krishna’s recent acknowledgment that IBM has replaced several hundred routine human resources roles with AI agents. Krishna’s comments underscore the unsettling reality confronting high-performing employees: roles centered around “rote process work” are rapidly becoming obsolete. Although IBM has reallocated some resources toward roles in software development and sales, the underlying message is clear.

The bottom line is that gen AI is redefining all forms of knowledge work much faster than anyone, including the industry’s elite consultants, leaders and partners, expected.

AI layoffs are sparking a survival mindset

Fearing they may be caught up in sweeping layoffs driven by AI and automation, many of the industry’s elite consultants and high performers are reinventing themselves quickly before their roles vanish.

Teams in the hardest hit areas often have dozens of shadow AI apps designed to improve efficiency and team productivity. Proposal and pitch automation, operations and workflow automation, financial modeling, scenario analysis, and client relationship managers being replaced by firm-specific copilots are where shadow AI flourishes. Many are relying on Python-based shadow AI to build custom automation tools, bypass internal IT bottlenecks, and deliver faster, differentiated insights that protect their roles in an industry under pressure from gen AI.

Python is becoming the language of reinvention

VentureBeat has learned that many of the top-tier strategists, marketers, practice leaders and their teams are becoming proficient in creating Python-based apps that can take analysis and insights beyond the existing genAI tools provided by IT. Teams creating these apps are proficient with Open AI, Google programmable search engines, Google Gemini 2.5 Pro, Perplexity and other AI platforms’ API keys and calls. Platforms of choice for fine-tuning shadow AI apps include Google Colab and Google AI Studio. Many are using Replit to create standalone apps.

Building Shadow AI apps with enterprise-grade reach

By combining a series of APIs and search engine IDs from Anthropic, Perplexity, Open AI and Google, the speed, accuracy and acuity of insights, associates’  shadow AI apps deliver reach beyond the current scope of legitimate, IT-approved copilots and chatbots. One SME leader confided to VentureBeat that the combination of APIs and Python fine-tuning makes it possible to create apps so hyper-customized to a client’s goals that it’s saving him days of manual work aggregating and analyzing data.

Associates at top firms globally have created dozens, and in some cases hundreds, of unique Google Search Engine APIs and IDs to power their Python apps. These APIs provide precise, real-time integration of external data directly into their shadow AI tools, further boosting their analytical edge.

Shadow AI is quickly emerging as the new consulting stack

An analysis by Cyberhaven of AI usage across three million employees found that 73.8% of workplace ChatGPT accounts were personal rather than corporate, indicating that most consultants turn to these tools independently. Cameron Coles, VP of Marketing at Cyberhaven’s blog post last month, AI Usage at Work Is Exploding — But 71% of Tools Put Your Data at Risk, provides insights into what kind of data is most often shared across shadow AI apps and the rapid growth of the category.

Coles writes, “AI usage at work continues its remarkable growth trajectory. In the past 12 months alone, usage has increased 4.6x, and over the past 24 months, AI usage has grown an astounding 61x. This represents one of the fastest adoption rates for any workplace technology, substantially outpacing even SaaS adoption, which took years to achieve similar penetration levels.”

Within top consulting firms, the proliferation of self-built, unauthorized apps continues to be explosive. Itamar Golan, CEO of Prompt Security, notes, “We see 50 new AI apps a day, and we’ve already cataloged over 12,000,” highlighting how rapidly these shadow tools are emerging. He recently told VentureBeat during an interview that “many default to indiscriminately training on proprietary data inputs,” exposing firms to substantial risk. Internal data confirms that 70–75% of consultants now regularly rely on generative AI apps, directly attributing productivity gains to shadow AI apps. It’s become the weapon of choice for consulting’s top talent, enabling them to produce exceptional work in a fraction of the time.

VentureBeat interviewed Golan, Vineet Arora, CTO of WinWire, and senior leaders at fourteen leading global consultancies to understand the breadth of shadow AI adoption.:

Estimating the true scale of shadow AI in consulting

While most enterprise tools still fail to detect the scale of shadow AI use, field interviews and telemetry from Prompt Security, WinWire and interviews with 14 top-tier consulting firms make one thing clear: shadow AI is no longer a fringe phenomenon. It’s emerging as a parallel tech stack built from the ground up by consultants themselves.

VentureBeat’s estimate incorporates:

• Prompt Security telemetry, which detects ~50 new shadow AI apps per day and has already cataloged 12,000+ tools across consulting firms globally.
• WinWire enterprise AI data, covering Gemini, GPT-4, Claude 3 and Colab-based deployments.
• Cyberhaven usage data, which reveals that 73.8% of ChatGPT workplace accounts are unauthorized, and enterprise AI usage has grown 61x in 24 months.
• 14 executive interviews with CTOs, CISOs, AI leads and partners across Tier 1 firms.

Only actively deployed, production-grade tools are counted, not one-off prompts, temporary Google Colab notebooks, or ChatGPT browser sessions. These numbers reflect a validated lower bound, likely far short of the true total.

Shadow AI app landscape in consulting, 2025 (Verified Estimate)

Sources: Prompt Security, WinWire, Cyberhaven, VentureBeat interviews with 14 global firms

Shadow AI growth trajectory: What comes next

Shadow AI is scaling faster than any sanctioned internal platform, and most firms have no real way to slow it down. Based on a conservative 5% month-over-month growth rate, the number of actively used shadow apps could more than double by mid-2026.

What started as isolated productivity scripts has evolved into something more durable. Shadow AI is no longer a fringe toolset. It is now a parallel delivery stack. It operates outside IT, without formal governance, yet it powers many of the high-value outputs firms deliver to clients every day.

Projected shadow AI app growth in consulting

These projections exclude one-off use of ChatGPT or Gemini in browser sessions. They reflect persistent apps and workflows built using APIs, scripting, or automated agents developed inside consulting teams.

How to strategically manage shadow AI risks

Shadow AI is thriving because traditional IT and cybersecurity frameworks aren’t designed to track its use. IT and security teams in nearly every enterprise VentureBeat spoke with have three to five times the number of projects they can complete this year. While getting a new copilot out is a high priority, it can face resource and approval hurdles as a result.

Arora underscores that “most traditional management tools lack comprehensive visibility into AI apps,” enabling unauthorized AI to quietly embed itself within enterprise workflows.” Arora’s insights reveal an underlying truth: Employees aren’t acting maliciously; they’re fearful of being let go while simultaneously overwhelmed with work, leveraging AI to cope with escalating workloads, shrinking deadlines, and relentless performance expectations.

Rather than stifling AI adoption, Arora advocates proactive empowerment through strategic, centralized governance. By institutionalizing clear oversight, organizations can harness AI securely, transforming shadow AI from an unseen threat into a controlled asset.

A blueprint for governance

Consultancies’ senior management teams need a clear, practical roadmap to get in front of shadow AI risks and harness its strategic potential. Arora outlined a detailed governance framework during a recent interview with VentureBeat, explicitly designed for enterprises navigating the complexities of shadow AI:

• Shadow AI audits are table stakes:
  Regularly take inventory of all unauthorized AI activity through robust network monitoring and detailed software asset management.

• Create an Office of Responsible AI:
  Centralize AI governance functions spanning policy creation, vendor assessments and risk analysis, and maintain an approved AI tools catalog accessible to all teams.

• Get AI-aware security controls in place immediately:
  Deploy specialized Data Loss Prevention (DLP) tools and real-time inference monitoring capable of detecting sensitive data leaks specific to AI applications in real-time.

• Go all in on applying zero trust to AI architectures:
  Adopt strict output validation protocols, anonymize or tokenize sensitive inputs, and rigorously manage data flows to minimize exposure and prevent unauthorized data training.

• Find out where the roadblocks are to getting more gen AI tools out now:
  Every organization can improve on the speed at which it deploys new technologies. Find out where the gaps and roadblocks are holding the consultancy back from delivering more adept copilots and chatbots. It is essential to get a roadmap defined for IT and DevOps to work on for internally suggested Python apps, fine-tuned to client needs.

• GRC integration and continuous training:
  Integrate AI governance within existing governance, risk, and compliance (GRC) frameworks, and consistently consult on secure, compliant AI practices.

• Avoid blanket bans, it’s fuel for even more shadow AI app development:
  Recognize that outright AI bans inevitably backfire, increasing shadow AI proliferation. Instead, rapidly deploy secure, sanctioned alternatives that enable compliant, productive innovation.

From underground tools to enterprise edge

Initially an underground productivity hack, shadow AI has emerged as a decisive factor in how top-tier consultants deliver differentiated client value. Driven by a stark survival imperative amid widespread AI-triggered layoffs, elite talent now relies on Python-driven, generative AI-powered solutions, enabling uniquely tailored client insights and rapid responses to their clients.

Consulting firms that are slow to adapt or hesitant to strategically harness these innovations strategically risk forfeiting their future competitive edge. The path forward demands not prohibition but thoughtful, secure integration of shadow AI and the transformation of potential risks into decisive strategic advantages.