{"id":7265,"date":"2025-12-18T15:23:49","date_gmt":"2025-12-18T20:23:49","guid":{"rendered":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/?p=7265"},"modified":"2025-12-18T16:51:49","modified_gmt":"2025-12-18T21:51:49","slug":"shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/","title":{"rendered":"Shadow AI Joins Shadow IT, Creating New Challenges for Risk & Security Teams"},"content":{"rendered":"

\"\"<\/p>\n

LogicGate’s Nicholas Kathmann offers commentary on shadow AI and how it creates new challenges for risk and security teams. <\/strong><\/em>This article originally appeared in Insight Jam<\/a>, an enterprise IT community that enables human conversation on AI.<\/span><\/strong><\/em><\/p>\n

\"\"<\/a><\/p>\n

People are always searching for a simpler way to do things. \u201cThere\u2019s an app for that\u201d has become a clich\u00e9 as developers look for new ways to make the lives of their users easier. But while a scheduling app or a notetaking feature might be helpful in your personal life, the dynamic changes when these applications are used in a work environment. If a shady calendar app steals your personal information, that\u2019s one thing. But if it steals your employer\u2019s data\u2014or worse, customer or client data\u2014that\u2019s an unacceptable risk. The use of unapproved applications on company devices has become known as \u201cshadow IT,\u201d and it poses a significant problem for security and IT departments.<\/p>\n

The advent of AI has exacerbated the issue even further. After all, AI is the ultimate Swiss army knife\u2014employees are using generative AI tools to do everything from summarize articles to analyze complex data sets\u2014and this is creating significant challenges for security and risk management teams. Much of the risk around today\u2019s generative AI tools centers around improper sharing of sensitive or confidential data, and if risk management teams cannot control (or even see) what information is being shared with those tools, that\u2019s a real problem. Today\u2019s organizations don\u2019t just need to worry about shadow IT\u2014they need to recognize and mitigate the threat of shadow AI as well.<\/p>\n

The Rising Threat of Shadow AI<\/strong><\/h3>\n

When it comes to shadow AI, visibility is one of the biggest challenges. It\u2019s not just that organizations lack the ability to detect unauthorized AI usage\u2014it\u2019s that many aren\u2019t even looking. The 2025 IBM Cost of a Data Breach report focused heavily on the issue of shadow AI, and researchers found that just 34% of organizations perform regular checks for unsanctioned AI use, leaving employees free to experiment with a wide range of AI tools with little to no oversight. That\u2019s less than ideal, especially since 20% of the organizations studied in the report indicated that they have suffered a breach that involved shadow AI. Worse still, breaches involving shadow AI cost organizations an average of $670,000 more than those without the involvement of shadow AI.<\/p>\n

Unfortunately, the fallout from shadow AI doesn\u2019t end there. The involvement of shadow AI in a data breach was found to result in a greater volume of personal identifiable information (PII) and intellectual property being compromised. Additionally, that data was frequently stolen from multiple locations, highlighting the fact that unauthorized AI usage can create risks and vulnerabilities that span a wide range of environments. The problem is so severe that IBM now considers shadow AI one of the three most costly breach factors tracked in its annual report, even overtaking the ongoing skills shortage. Shadow AI isn\u2019t just a theoretical problem anymore\u2014it is having a real, quantifiable impact on businesses across a wide range of industries.<\/p>\n

Establishing Guardrails for Around Shadow AI<\/strong><\/h3>\n

While it\u2019s true that identifying and preventing the use of shadow AI is difficult, there are simple steps that organizations can take to mitigate its impact. Generative AI tools like ChatGPT, Gemini, Perplexity, and others are freely available to the public\u2014but more importantly, they are largely browser-based. IT and security teams can (and should) track when employees visit those websites, and if it is determined that employees are regularly turning to ChatGPT during the course of their work, it\u2019s a good idea to examine what information they may be sharing.<\/p>\n

If necessary, organizations can limit (or even block) access to those websites, although this is a double-edged sword\u2014blocking generative AI tools entirely may simply lead employees to use them on their personal devices where IT has less control. Cutting off access to AI tools entirely also risks stifling innovation, especially for businesses in rapidly modernizing industries. AI itself isn\u2019t the problem here\u2014it\u2019s determining how to use it safely and securely. A strong risk management platform can help organizations better understand the risks and benefits associated with these actions.<\/p>\n

It’s also important for security training sessions to include AI awareness training. Even those who use AI on a regular basis don\u2019t always understand what it is, how it works, or what constitutes risky activity. It\u2019s important for every business to have a clearly laid out AI governance plan that details which use cases and solutions are permitted and why, and additional training sessions should be held whenever new tools or use cases are adopted. The training element is essential here: the truth is, most employees won\u2019t read written guidelines, which means organizations need to find other ways to encourage their workers to listen to the policy, answer questions, and engage with the training. Regrettably, these policies do need to have teeth. An AI governance policy that exists only on paper isn\u2019t governance at all. Shadow AI creates real risk for the business, and repeated violations need to carry consequences.<\/p>\n

Mitigating Trickier Shadow AI Risks<\/strong><\/h3>\n

Unfortunately, some shadow AI activity is more difficult to pinpoint. As businesses increasingly embrace AI capabilities, SaaS providers are often enabling AI features by default, forcing users to opt out rather than opt in. That means the scheduling tool, notetaking app, or audio recorder your business uses may include AI functionality you never asked for\u2014and may not even be aware of. The average company now uses more than 100 different SaaS applications, and it can be difficult for IT and security teams to stay on top of which ones provide AI capabilities\u2014especially since new features are added on a regular basis. Employees may use a company messaging service to collaborate, but if that service has AI functions switched on, it may not be a safe place to discuss sensitive or confidential matters.<\/p>\n

Addressing that challenge is a bit more complex. Establishing a more stringent vetting process for vendors is an important first step. Different companies have different approaches to privacy and security\u2014some AI providers lay claim to any data shared with them, while others pledge to delete information as soon as it is entered. Business should already be thoroughly vetting end-user license agreements (EULAs) before signing on with any partner, but it\u2019s increasingly important to identify any language pertaining to data ownership, AI model training, and other potentially risky elements. One way to limit risk is to avoid working with vendors that cannot<\/p>\n

promise the necessary level of data privacy, as well as vendors with a history of data breaches or careless behavior. It won\u2019t solve the whole problem, but it will help limit the potential impact of shadow AI usage.<\/p>\n

Reducing Exposure to Unnecessary Risks<\/strong><\/h3>\n

AI governance remains a work in progress for today\u2019s businesses, but addressing the issue of shadow AI needs to be a priority. Risk and security professionals must work in lockstep to establish visibility into when, where, and how AI tools are being used within the organization and understand the associated risks. By limiting access to the riskiest tools, establishing strong training programs, and vetting partners and vendors based on their approach to AI and data security, today\u2019s businesses can significantly mitigate the dangers posed by shadow AI usage. Shadow AI isn\u2019t going away\u2014it\u2019s a problem that will be with us for quite some time. But the right approach can help organizations avoid leaving themselves exposed to unnecessary risks.<\/p>\n","protected":false},"excerpt":{"rendered":"

LogicGate’s Nicholas Kathmann offers commentary on shadow AI and how it creates new challenges for risk and security teams. This article originally appeared in Insight Jam, an enterprise IT community that enables human conversation on AI. People are always searching for a simpler way to do things. \u201cThere\u2019s an app for that\u201d has become a […]<\/p>\n","protected":false},"author":1383,"featured_media":7267,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[1156,1357],"acf":[],"yoast_head":"\nShadow AI Joins Shadow IT, Creating New Challenges for Risk & Security Teams<\/title>\n<meta name=\"description\" content=\"LogicGate's Nicholas Kathmann offers commentary on shadow AI and how it creates new challenges for risk and security teams.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nicholas Kathmann\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/\",\"url\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/\",\"name\":\"Shadow AI Joins Shadow IT, Creating New Challenges for Risk & Security Teams\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2025\/12\/Endpoint-Security-2.jpg\",\"datePublished\":\"2025-12-18T20:23:49+00:00\",\"dateModified\":\"2025-12-18T21:51:49+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/e27358eda657c459a2b6ce294ad284c9\"},\"description\":\"LogicGate's Nicholas Kathmann offers commentary on shadow AI and how it creates new challenges for risk and security teams.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2025\/12\/Endpoint-Security-2.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2025\/12\/Endpoint-Security-2.jpg\",\"width\":800,\"height\":400},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Shadow AI Joins Shadow IT, Creating New Challenges for Risk & Security Teams\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#website\",\"url\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/\",\"name\":\"Best Backup and Disaster Recovery Tools, Software, Solutions & Vendors\",\"description\":\"Solutions Review\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/e27358eda657c459a2b6ce294ad284c9\",\"name\":\"Nicholas Kathmann\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2025\/12\/Nicholas-Kathmann-scaled.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2025\/12\/Nicholas-Kathmann-scaled.jpg\",\"caption\":\"Nicholas Kathmann\"},\"description\":\"Nick Kathmann is LogicGate\u2019s Chief Information Security Officer (CISO). With more than 20 years of IT experience, he has spent the past 18+ years helping enterprises of all sizes strengthen their cybersecurity postures. He has built and led several teams delivering cybersecurity solutions for complex, business-critical environments ranging from SMB to Fortune 100 companies, based on-premises in traditional data centers and in the cloud. He is also experienced across a variety of specific sectors, including healthcare and financial services. Prior to his current role, Kathmann served as director of cybersecurity at Dell Technologies, overseeing the internal cybersecurity program, among other responsibilities.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/nicholaskathmann\/\"],\"url\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/author\/nkathmann\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Shadow AI Joins Shadow IT, Creating New Challenges for Risk & Security Teams","description":"LogicGate's Nicholas Kathmann offers commentary on shadow AI and how it creates new challenges for risk and security teams.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/","twitter_misc":{"Written by":"Nicholas Kathmann","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/","url":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/","name":"Shadow AI Joins Shadow IT, Creating New Challenges for Risk & Security Teams","isPartOf":{"@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2025\/12\/Endpoint-Security-2.jpg","datePublished":"2025-12-18T20:23:49+00:00","dateModified":"2025-12-18T21:51:49+00:00","author":{"@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/e27358eda657c459a2b6ce294ad284c9"},"description":"LogicGate's Nicholas Kathmann offers commentary on shadow AI and how it creates new challenges for risk and security teams.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/#primaryimage","url":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2025\/12\/Endpoint-Security-2.jpg","contentUrl":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2025\/12\/Endpoint-Security-2.jpg","width":800,"height":400},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/shadow-ai-joins-shadow-it-creating-new-challenges-for-risk-security-teams\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/"},{"@type":"ListItem","position":2,"name":"Shadow AI Joins Shadow IT, Creating New Challenges for Risk & Security Teams"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#website","url":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/","name":"Best Backup and Disaster Recovery Tools, Software, Solutions & Vendors","description":"Solutions Review","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/e27358eda657c459a2b6ce294ad284c9","name":"Nicholas Kathmann","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/image\/","url":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2025\/12\/Nicholas-Kathmann-scaled.jpg","contentUrl":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2025\/12\/Nicholas-Kathmann-scaled.jpg","caption":"Nicholas Kathmann"},"description":"Nick Kathmann is LogicGate\u2019s Chief Information Security Officer (CISO). With more than 20 years of IT experience, he has spent the past 18+ years helping enterprises of all sizes strengthen their cybersecurity postures. He has built and led several teams delivering cybersecurity solutions for complex, business-critical environments ranging from SMB to Fortune 100 companies, based on-premises in traditional data centers and in the cloud. He is also experienced across a variety of specific sectors, including healthcare and financial services. Prior to his current role, Kathmann served as director of cybersecurity at Dell Technologies, overseeing the internal cybersecurity program, among other responsibilities.","sameAs":["https:\/\/www.linkedin.com\/in\/nicholaskathmann\/"],"url":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/author\/nkathmann\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/posts\/7265"}],"collection":[{"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/users\/1383"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/comments?post=7265"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/posts\/7265\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/media\/7267"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/media?parent=7265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/categories?post=7265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/tags?post=7265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}