One in five firms hit by security incident from shadow AI: report
An unapproved AI connection has already led to a security incident for one in five firms, according to a new report, which called for greater focus on addressing shadow AI in the wake of rising cybersecurity budgets.
DNSFilter's latest poll among 400 IT and cybersecurity professionals across North America revealed a visibility issue when it comes to AI tools being used in the workplace.
It found that 54% of firms already use AI governance or monitoring controls to identify incidents involving third-party tools.
However, 46.1% have had an employee connect an unapproved AI tool to their Google Workspace, Microsoft 365, or SSO environment anyway, leading to a security incident in 20.1% of these firms.
The report also found that 36.8% of organisations whose employees use AI tools for work allow staff to approve OAuth or API access to corporate systems when a new AI tool requests it, with IT notified only after the fact.
Another 6.5% grant permission without notifying at all.
"That is 43% of organisations where the decision to connect an AI tool to corporate data is made by someone who does not own the risk," the report read.
These shadow AI-linked security incidents come despite previous warnings from experts that employees' unapproved and unmonitored use of AI tools can lead to consequences.
Menlo Security, a browser security firm, also previously warned that growing shadow AI in the workplace puts organisations at risk of data loss or data leakage.
"While data loss is a legitimate concern in the enterprise, data leakage, in which sensitive information is inadvertently exposed, can be a bigger issue, particularly when it comes to GenAI," its report read.
Improving cybersecurity
To address the problem, employers are boosting their cybersecurity budgets, with AI security and governance now their top spending priority.
DNSFilter's latest report showed that 74.5% of firms will have a larger cybersecurity budget than they had 12 months ago. Among them, 18.8% grew theirs by more than 10%.
AI security and governance topped the list of priorities for organisations when it comes to their cybersecurity budgets, as cited by 40.3% of the respondents.
This is nearly 15 percentage points ahead of employers prioritising cloud security, which is only at 25.5%.
But the report warned that governance spending is not the same as governance. It noted that while the budget bought the company a policy, the tools are still getting connected to the environment, sometimes without visibility.
"Organisations are spending to govern AI, but you can't govern what you can't see. On a normal business day, roughly one in seven organisations on our network connects to more than 10 AI tools, yet fewer than one in 100 IT leaders believe that's happening in their environment," said Ken Carnesi, CEO, DNSFilter, in a statement.
"In too many companies, the decision to connect an AI tool to corporate data is being made by someone who doesn't own the risk. Closing that gap has to be the focus of the next round of spending."
