Shadow AI infiltrates at least half of organizations, making this a major threat
getty
AI adoption is moving at breakneck speed, but in the rush to innovate and stay ahead of the game, leaders and professionals are overlooking one major problem:
Shadow AI.
Shadow AI refers to the use of AI tools without prior approval or visibility at the enterprise IT level, creating heightened workplace risks.
A recent BlackFog report highlighted that productivity pressure is pushing senior leaders to bypass AI safeguards, increasing exposure to data leakage.
Their survey of 2,000 respondents found that 86% of professionals use AI tools at least weekly for work-related tasks. Of that group, more than a third admit to using free versions of company-approved AI tools, which are not subject to the same enterprise-level security and data governance. And about half admit to using AI tools not sanctioned at work.
Even more striking:
- About 63% of respondents agreed it’s acceptable to use AI tools without IT oversight if no company-approved option is provided.
- Meanwhile, 60% said using unsanctioned AI tools is worth the security risk if it enables them to work faster and meet deadlines.
- To make matters worse, 21% said their employer would turn a blind eye to them using unapproved AI tools as long as they meet milestones.
Leaders Model Poor AI Usage
But the risk becomes even more serious when leaders are leading by example–modelling the wrong behavior.
One of the key findings of the study was that senior-level leaders are especially likely to prioritize speed over security. According to the report, these leaders believe the speed benefits of using AI tools outweigh privacy and security risks:
- About seven in 10 (69%) of those at the president or C-suite level
- And about 66% of those at director or senior vice president level
What AI Speed Over Security Costs Organizations
So what is being shared?
- A third of employees say they share research and datasets.
- Another 27% share employee data, including payroll information and performance data.
- Just under a quarter have shared sensitive financial and revenue data.
To heighten this risk even further, more than half of employees admit to integrating AI tools with other work systems using APIs, without IT department approval or oversight.
How Leaders Can Safely Keep Up With Emerging Tech
Yesterday I spoke with ISC2’s CEO, Scott Beale, to understand exactly what this risk requires of leaders today.
He explained:
“If you don’t have AI tools and policies in place, your staff are going to do it on the side. And they are going to use these tools because it’ll make their lives more efficient and effective. But if it doesn’t have that security of the organization, if you’re not keeping in mind where data might go, then you could have information stolen, you could have prompt injections into software like you could have secrets gone, you could have, I mean any number of things that could shut down your business or put your staff or members or customers at risk.
“All because that company is almost too afraid to implement policies that allow people to use these tools in safe and secure ways,” he said.
“Sitting on your hands actually isn’t an option,” Beale advised. “And telling people, oh just don’t use it, is really not the best approach either.”
Beale used the invention of the car and the development of frameworks and systems to support safe driving as a parallel to the evolution of AI in this new Industrial Revolution.
“If everyone else is driving in a car, your employees want to get in a car as well. But you need to get people the education–in some cases certifications or licenses to show that they know how to use it.
“For example, you’re not just letting your kid get in the car and go crazy with it, but you’re giving people who have experience the policies in place and let them use the car. There’s still risks associated with the car. But if they’re properly trained and they have rules of the road then you can go a long way with using the technology properly.”
Leaders should balance curiosity with diverse teams to ensure balanced AI implementation
getty
But in all fairness to leaders, now is one of the most challenging times to lead.
Leaders and managers are facing the daunting reality of keeping up with the pace of emerging tech, while at the same time ensuring reliability, trust, and safety are upheld. It’s a delicate balancing act.
Beale acknowledged, “Yeah, I mean it’s tough. I think it feels like you see in the news a greater turnover of CEOs, even in some of the largest companies in the world.”
He believes that the AI era demands a different type of leader: “It does feel like those CEOs and leaders who have risen over the last 10 years may not even be the same ones who are able to navigate the future in the next 10 years,” he reflected.
“And certainly I believe that a lot of the basics and principles of leadership haven’t changed. But you do need a leader who is comfortable in this new and uncertain world and knows how to either deal with the technology, or is curious and knows to surround themselves with people who are really experts on it.”
What Leaders Need To Do Now When Implementing AI
His top advice for senior leaders navigating this era?
- Remain open and explorative
- Observe what other industry leaders are doing and create balance
- Laser focus on the technologies and trends that are most relevant to your organization.
- Start small and pilot, looking out for clear success metrics and ensuring a secure-by-design approach is maintained from the beginning.
- Surround yourself with people who have diverse perspectives.
Shadow AI is a real risk. It could already be inside the work operations of your organization.
Turning a blind eye, especially as a leader, is not an option.
Because by the time you’re ready to address the issue, you’re already exposed and the policy arrives too late.
