Hiding in plain sight: The shadow AI crisis nobody wants to own

It is already inside your organisation. It is in your finance team's browser tabs, your commercial team’s workflows, and your HR department's document drafts. Employees are feeding sensitive data into consumer AI tools daily: intellectual property, client information, source code, and internal strategy. And nobody is watching. This is Shadow AI, and unlike its predecessor Shadow IT, it is growing at a pace that makes proactive management difficult.

The numbers are scary. Nearly half of all generative AI users in the enterprise are accessing tools through personal accounts that their organisation has no visibility over. Data policy violations related to AI usage more than doubled in a single year. The volume of prompts being sent to AI tools, and the sensitive data contained within them, is growing month on month with no signs of slowing. And here is the detail that should stop every security leader in the room: research shows that 68% of CISOs and security leaders admit to using unauthorised AI tools themselves. The crisis does not start on the shop floor. It starts at the top.

This session confronts the uncomfortable reality that Shadow AI is not a rogue employee problem, it is a governance failure. Organisations are racing to capture the productivity benefits of artificial intelligence while simultaneously under-investing in the controls, policies, and cultural frameworks needed to manage it safely. The result is a sprawling, largely invisible attack surface that security teams are only beginning to understand.

Drawing on real-world and ongoing experience deploying and governing AI tools inside a complex organisation, this session explores what Shadow AI actually looks like on the ground in the fast-moving reality of an organisation trying to do the right thing while keeping pace with demand.

Attendees will explore:

• Why banning AI tools makes the problem worse, not better, and what actually works.
• How to classify AI tools and data so that governance is practical, not paralysing.
• The role of tooling, from CASB and DLP platforms to purpose-built Shadow AI detection solutions, and where each fits in a mature governance stack.
• Why the approval pathway for AI tools must be fast, simple, and visible, or employees will route around it every time.
• How to build a culture where responsible AI use is the path of least resistance.

This is a session for CISOs, CIOs, and senior IT leaders who are tired of being told Shadow AI is a problem and are ready to do something about it. The crisis is real, it is growing, and right now, nobody wants to own it.

It’s in your hands to change, so let’s put something in those hands.