Shadow AI: how a company loses confidentiality due to the lack of its own AI
Every fifth company that experienced a data leak at least partially links it to unauthorized use of AI. These are "Informzaschita's" data for July. A year earlier, there were about 12%. Netskope, in its January report this year, looks from a different perspective: almost half of the employees who use generative AI at work access it through personal accounts. Security services hardly see them. This picture is familiar to me: we went through the journey from subscriptions to the question "what are we uploading there?" ourselves. At first, the idea took root in the business environment: those who don't work with ChatGPT or Claude are falling behind. Everyone rushed to get subscriptions. Then the second question came, and it turned out to be more important. A contract, client data export, financial report, a snippet of code — all of this is already outside the company. Developers were the first to encounter a simple thing: send even a line of code to the chat — and it's already outside the company. And without the code, AI is almost useless for a programmer. Shadow AI is not about employee discipline. It's a signal that the company hasn't provided them with a convenient and secure tool. As long as the safe path is more difficult than the dangerous one, people will choose the dangerous path.
Share
