Use of artificial intelligence (AI) has grown rapidly in many workplaces with employees increasingly exploring how such tools can be incorporated into their jobs. AI can help people complete tasks more quickly, improve decision-making, save costs and increase productivity. However, organisationsโ policies and guidance, which should reflect and manage the risks associated with using these new technologies, have not always developed at the same pace.
Rather than preventing them from using AI, this can mean employees turn to using AI tools that have not been approved by their organisation, introducing new cyber security risks that can be hard to identify. So says the UK official National Cyber Security Centre (NCSC) in a blog about ‘shadow AI’.
The NCSC defines Shadow AI as the use of AI technology which isnโt captured in an organisationโs approved systems and processes. It is a form of shadow ITย (or โgrey ITโ).
Risks
Among the risks set out by the NCSC; employees who transfer sensitive or proprietary information to consumer AI services ‘will likely reduce the organisation’s visibility and control over that information. This is because that information may be stored, retained or used to improve the service’. If shadow AI can access company or customer data that ‘likely increases the risk of data breaches, intellectual property loss’. For the full blog visit https://www.ncsc.gov.uk/blogs/the-hidden-risks-of-shadow-ai.
Comment
Jamie Akhtar, CEO and Co-founder of CyberSmart, said: โThe NCSC is right to highlight shadow AI as a growing cyber security challenge. Employees are increasingly using AI tools to work faster and more efficiently, but when those services sit outside an organisationโs approved systems, businesses can quickly lose visibility over where sensitive company and customer data is being shared, stored or processed.
Simply banning AI is unlikely to solve the problem. Businesses need to provide secure, approved alternatives that allow people to benefit from AI without introducing unnecessary risk. Clear policies, employee education and appropriate technical controls all need to develop at the same pace as AI adoption.
For many organisations, particularly SMEs without large internal security teams, a managed service provider (MSP) can play an important role in closing that gap. An MSP can help businesses identify unapproved technology, put proportionate AI policies and controls in place, educate employees and continuously manage emerging risks, giving organisations the confidence to embrace AI while maintaining visibility and control over their security.โ
