Shadow AI Is Lurking - And Is Coming To Get Small Businesses!

Unauthorised AI use is affecting a quarter of UK small businesses.

But if shadow AI isn’t going to go away - what can you do in defence?

Some of the statistics in Pax8’s recently-released Pulse report on small-business AI use have shown how so many British SMBs are a wide-open door for cybercriminals.

In particular, 24% have found unauthorised AI tools operating within their businesses within the space of just six months. And that’s just those who have found that unauthorised use: how many more businesses still have that activity going on now, without even knowing?

It’s so easy for this kind of ‘shadow AI’ use to proliferate throughout an organisation, especially as employees become more familiar and comfortable with using their AI platform of choice. Official advice issued by the National Cyber Security Agency sums the situation up well:

“It may feel natural to stick with using the same AI service that you are familiar with from your personal life – but using systems that are not corporately approved can present real problems for your employer.”

Obviously, some shadow AI risks are bigger than others. For example, an employee taking a rough blog post and using AI to smarten it up is unlikely to cause an issue. But at the other end of the spectrum, uploading files containing sensitive data to an AI tool for processing, or giving an unknown AI agent access to email accounts, can pose real problems that IT - through a lack of awareness - are powerless to address.

The same NCSC guidance makes it clear that businesses will have to adopt a strategy of mitigation rather than eradication. With everyday AI use becoming so prevalent in so many people’s lives, as the NCSC puts it: “the use of shadow AI is unlikely to disappear completely”. 

So what’s a realistic course of action for small businesses, who are unlikely to have the manpower or resources to police AI use comprehensively? Education? Access controls? Championing authorised AI platforms? A combination of all of those? Or something else?

Get in touch with me on LinkedIn - I’d love to hear your ideas.