Tech IT Out: Taking Control of Shadow AI

Shadow AI: Balancing Innovation, Security & Control

In this episode, we discuss Shadow AI, the security, data privacy and compliance risks it creates, and how to govern and control it.

Your employees are going to use AI whether you have an AI strategy or not. So how do you give them the freedom to innovate without losing control of your data?

In this episode, our CCO Sam Mager is joined by our CEO Rupert Mills to discuss Shadow AI, why employees are increasingly using unapproved AI tools in the workplace, and the security, data privacy and compliance risks this can create.

They explore how organisations can identify Shadow AI and AI data leakage, the importance of AI governance and employee education, and why simply blocking generative AI isn’t the answer.

In this episode we cover:

• What Shadow AI is and why its use is growing in the workplace
• The security, data privacy and compliance risks of unapproved AI tools
• How to identify and manage Shadow AI and AI data leakage
• Building effective AI governance without restricting innovation
• Using Microsoft Purview and Microsoft 365 Copilot to support secure AI adoption

Whether you’re already adopting enterprise AI, using Microsoft Copilot or developing your wider AI governance strategy, this episode provides practical guidance on managing Shadow AI and enabling secure AI adoption across your organisation.

This episode covers some of these key Shadow AI Questions:

What is Shadow AI?

Shadow AI is the use of AI tools within an organisation without the knowledge, approval or governance of IT. This can include employees using platforms such as ChatGPT, Claude or other generative AI tools for work without formal approval.

Why is Shadow AI a risk for businesses?

Shadow AI can create data security, privacy and compliance risks by allowing sensitive business information to be shared with external AI platforms. Organisations may have little visibility over where that data goes, how long it is retained or how it is used.

How can organisations identify Shadow AI use?

Organisations can assess and monitor which AI tools are being used and how corporate data is moving to them. A Shadow AI assessment can identify unapproved AI platforms, data transfers and potentially risky API connections.

How can businesses prevent data leakage when employees use AI?

Businesses should combine AI governance, data controls, monitoring and employee education. Employees need clear guidance on approved AI tools, what information can be shared and when a new AI service requires approval.

Should businesses block employees from using AI tools?

Simply blocking AI is unlikely to be an effective long-term solution and may encourage employees to find alternatives outside corporate controls. Instead, businesses should provide approved AI tools and clear governance that enables employees to use AI safely.

What should be included in an AI acceptable use policy?

An AI acceptable use policy should define approved AI tools, permitted use cases, data-sharing rules and the process for approving new AI services. It should also establish how AI usage will be monitored and governed.

How can Microsoft Purview help organisations govern AI?

Microsoft Purview can help organisations classify, protect and govern sensitive business data before introducing tools such as Microsoft 365 Copilot. Reviewing data access and permissions can reduce the risk of AI surfacing information users shouldn’t have access to.

How can businesses balance AI innovation with security and compliance?

Businesses should enable AI within clear, controlled parameters rather than simply restricting its use. Approved platforms, risk assessments, employee education and ongoing Shadow AI monitoring can help organisations innovate while protecting corporate data.

Krome Cast Tech IT Out Podcast

If you’re navigating through the challenges of digital transformation, trying to build and maintain a stable and future-proof infrastructure that meets the needs of your business, or you just want to keep up to date with the industry challenges and trends, please head over to our YouTube Channel and hit subscribe!

Our podcast series features in-depth discussions. We cover a range of subjects including technology updates, tech challenges, trends and industry changes. Insights and best practices for IT leaders. Krome’s experience with client projects. How to overcome technical challenges. Considerations to make when embarking on specific upgrades, migrations, and installations. How-to guides and more!

Some of our technology podcasts are also available in audio-only format on all of the major podcast platforms, including Apple, Spotify, and Google Podcasts. It is also available with full video content on our YouTube Channel.

To view some of our other podcasts, please see some suggested episodes below.

• Backup & Disaster Recovery: Building Resilience
• IT Governance & Regulatory Compliance
• Understanding Microsoft Secure Score
• Microsoft Copilot Use Cases
• Microsoft Copilot Security & Compliance Risks
• Microsoft Purview Data Security and Compliance with M365