Employees' shadow AI use is poorly monitored, survey finds
Employee behavior has always presented one of the biggest enterprise cybersecurity challenges. Add AI into the equation, and education and governance become even more critical.
Despite cybersecurity professionals' best efforts to protect their organizations' networks and data, employees have long been the weak link in the chain. They click malicious links in emails, reuse weak passwords, share sensitive information and make other mistakes that threat actors exploit.
Then came generative AI, which promised productivity gains but created new security risks. Employees' unsanctioned use of AI tools now amplifies those risks at machine speed and scale.
Nearly half (47%) of cybersecurity professionals admit they lack full visibility into the AI tools used by their organizations' employees, according to a recent Bitdefender survey of 1,200 global cybersecurity professionals. The research also found a gap between what company leaders think they know about internal AI use and what frontline workers report. While 58% of IT and security managers said they have full AI visibility, just 46% of practitioners agreed. That means companies are likely underestimating the security risks that unsanctioned AI poses.
"This isn't a technology problem alone; it's also a governance vacuum," said the Bitdefender report. "Shadow AI may appear to be the new shadow IT, but it's harder to detect, and the potential for data leakage is orders of magnitude greater."
Shadow AI strategies for CISOs
A blanket AI ban can make a bad problem worse, according to Chase Cunningham, a zero-trust security expert, strategic advisor to several cybersecurity providers and chief strategy officer for software demonstration platform Demo-Force.
"A policy that simply says, 'Do not use generative AI,' is not a strategy," he said. "It frequently pushes usage further underground, where security teams have even less visibility."
Rather than restricting AI use, Cunningham argues that security leaders should first focus on understanding how employees use the technology. If they determine which shadow AI tools employees are using -- and why -- they can create governance policies that encourage workers to adopt AI responsibly rather than hide how they use it.
A policy that simply says, 'Do not use generative AI,' is not a strategy. It frequently pushes usage further underground, where security teams have even less visibility.
Chase CunninghamChief strategy officer, Demo-Force
"Organizations can't govern what they can't see," Cunningham added.
Internal corporate messaging often encourages users to adopt AI for business efficiency. But enterprises must also communicate AI risks, from data leakage to model hallucinations, in ways that resonate with nontechnical employees, said Erich Kron, CISO advisor at security awareness training provider KnowBe4.
"From compiling reports to writing or rewriting code, employees are aware of how AI can help them be more efficient, something critical in this modern day of doing more with less," Kron said. "Unfortunately, people do not hear about the problems that AI can cause."
Awareness by itself won't solve the problem of shadow AI, according to analysts. As the Bitdefender survey results suggest, organizations also need better visibility into how workers use AI tools across the business.
"What will characterize the ones that successfully manage such risk will be ... an up-to-date inventory of which generative AI services are sanctioned and which ones aren't," said Rik Turner, an analyst at Omdia, a division of Informa TechTarget.
AI visibility and governance are key, Cunningham agreed.
"Don't try to stop employees from using AI," he reiterated. "Stop them from using AI invisibly, indiscriminately and with more access than the task requires."
Craig Galbraith is the founder and owner of Galbraith Multimedia, an independent journalism company that provides writing, editing, video hosting, podcasting, onstage presentation and consulting services to the technology industry.
