Shadow IT vs Shadow AI: Key Risks and How to Manage Them
In this blog post, we aim to dig deeper into Shadow IT vs Shadow AI. We’ve already written many blog posts describing what Shadow IT is, but Shadow AI might be a fairly new concept, even for IT professionals. First, let’s recap what Shadow IT is and explore the major Shadow IT risks for organizations.
What is Shadow IT?
By definition, Shadow IT refers to any IT-related tools or services used by employees without oversight from the central IT department. However, nowadays, when we refer to Shadow IT, we typically mean cloud applications and SaaS services that employees access in an ad-hoc manner without central oversight or approval by the organization’s IT department.
For an organization, this can quickly become a significant issue as more and more web applications and SaaS services are used by employees to tackle the daily tasks their jobs require. Shadow IT poses substantial security risks, operational overhead, and management challenges for organizations.
What are the Shadow IT Risks for Organizations?
In this blog post, we’ll focus on the two biggest security concerns: Shadow IT visibility and password hygiene.
Shadow IT Visibility
Shadow IT discovery and visibility are the biggest concerns for organizations when it comes to Shadow IT. Due to the nature of SaaS and cloud services, it’s very easy and convenient for employees to simply register an account and start using the service right away. Many times, these services offer free tiers, which might meet the users’ needs, so they don’t even require financial approvals. Alternatively, users might just pay with their corporate credit cards if the price is low enough.
The problem for organizations is that these accounts are only known to the employees themselves. The IT department is unaware of these apps and accounts, resulting in a lack of visibility. This creates significant overhead in IT support and challenges in securing cloud access. For example, credentials used for these services are not checked for compliance with best practices or the organization’s internal guidelines. Additionally, users often overlook data protection, privacy policies, and terms of use.
Almost all industry regulations require an inventory of the software and services used. This is also essential for internal processes. For instance, if an employee leaves the organization, they might still retain lingering access to SaaS tools, supply chain portals, and other resources.
Shadow IT and Password Hygiene
Another major issue with Shadow IT is password hygiene. Typically, users tend to create simple, easy-to-remember passwords for SaaS and other cloud apps. Even worse, they may reuse their corporate credentials for these services. This significantly increases the organization’s attack surface, as these seemingly random third-party cloud services are usually more prone to cybersecurity vulnerabilities. These services often prioritize functionality over security aspects. Breaches of such services happen daily, and stolen credentials frequently end up on the dark web in combo lists. Attack techniques like credential stuffing and password spraying can then be highly effective in compromising corporate resources. The latest edition of the Verizon DBIR report states that 79% of successful companies begin with stolen credentials. Usually, these credentials are not stolen from major providers or corporate IT infrastructures but rather from smaller SaaS and similar cloud providers.
Using SSO to sign up for a service can help reduce password-related risks, as passwords are not directly involved. However, this may lead to an even bigger Shadow IT visibility gap if the work-related account becomes associated with a private identity provider, such as the user’s personal Google or Microsoft account. Even when a corporate identity provider is used, the access may remain invisible to the IT department.
How Shadow AI is different from Shadow IT
Shadow AI is not much different from Shadow IT. In fact, it shares all the same problems, as AI tools are often just a subset of SaaS solutions. They operate in the same way—users create accounts and gain access immediately. The Shadow AI visibility gap and the Shadow AI security risks are essentially the same as with Shadow IT.
However, there are a few notable factors that might make Shadow AI an even bigger security concern for organizations.
55% of employees reported using unapproved generative AI technologies at work, raising concerns about data security.
Rapid Adoption of GenAI Tools Leads to ShadowAI
The adoption rate of cloud-based AI tools is faster than nearly anything we’ve seen before. Employees quickly realize that many of their daily, mundane tasks can be automated or improved by using AI tools. This leads to the rapid growth of Shadow AI within organizations.
Using AI Tools May Even Be Encouraged by Executives
Executives within organizations also recognize that AI tools can significantly boost workforce productivity. Consequently, the use of AI tools might even be endorsed and promoted by C-level executives, further contributing to the spread of Shadow IT and Shadow AI.
AI Tools and Security
The AI service market is evolving rapidly, creating a race to launch products faster. As a result, many AI tools prioritize core functionality over necessary security features and considerations. This lack of security focus can result in vulnerabilities and a greater loss of control for IT departments. This is why Shadow AI can further increase an organization’s attack surface.
Most AI Tools Require Data Input
It’s rare for AI tools to produce usable outputs without input data. Usually, users must upload sensitive data for the tools to process. This creates significant security concerns for organizations. For example, a developer might upload source code to fix bugs, or HR and finance employees might upload spreadsheets containing live corporate data to generate reports or automate tasks. The range of potential data leaks and security risks is vast.
What Can Organizations Do to Handle Shadow AI and Shadow IT?
It all begins with Shadow IT monitoring and Shadow AI visibility. Without visibility into SaaS and cloud services, it’s impossible to manage the risks these tools pose. When addressing Shadow AI and Shadow IT visibility, organizations need full coverage. It’s not enough to rely solely on network or endpoint logs to detect well-known providers. The goal should be to achieve as close to 100% visibility as possible, which typically requires a dedicated solution.
It’s also essential to understand that restricting employees from using SaaS and other cloud services entirely is not practical. The tools often provide valuable features that enhance agility and productivity.
The ideal approach is to embrace Shadow AI and Shadow IT while creating an environment where employees can use these resources in a monitored and controlled manner. Raising awareness about security risks, notifying users, and involving them in resolving potential issues is crucial, as employees are often best positioned to address Shadow IT and Shadow AI challenges within their workflow.
