How are you managing the security risks associated with "Shadow AI" in your workforce?

All answers to this question.

Dealing with Shadow AI has become a weekly battle in our IT department. Among current Cybersecurity Trends, "human-centric security" is becoming the focus. We realized that if we just block ChatGPT, people will find a way around it on their phones. Instead, we’ve deployed an internal, private instance of a large language model where the data stays within our Azure tenant. This allows our developers to stay productive while ensuring that proprietary code or client data never leaves our controlled environment. It’s about providing a safe alternative rather than just saying no.

   Answered 2025-02-13 by Sandra Jenkins

Have you noticed any specific departments that are more prone to bypassing these controls? I suspect marketing and dev teams are the main culprits.

   Answered 2025-02-15 by Paul Roberts

• You're spot on, Paul. Marketing often uses it for content, and Devs use it for debugging. The danger is when they paste raw logs or customer names into the prompts. We’ve had to implement strict training and automated DLP (Data Loss Prevention) triggers that scan for sensitive patterns before a prompt can be submitted to any external web service.

     Commented 2025-02-16 by Edward King

A robust Cloud Access Security Broker (CASB) is essential here. It gives us the visibility to see which "unapproved" AI apps are being accessed so we can address the risk.

   Answered 2025-02-17 by Lisa Turner

• Exactly, Lisa. Visibility is the first step. You can't secure what you can't see, and CASBs are perfect for identifying those hidden trends.

     Commented 2025-02-18 by Larry Watkins