Your security team has a policy. Your approved tools list exists. Right now, someone in your organization is probably pasting sensitive data into an AI tool nobody reviewed. Here's what shadow AI actually is and why it's already inside your organization.