Shadow IT, shadow AI and insider risk: Why controls fail, and culture matters more

Organisations continue to invest heavily in security controls, approved tools, training and policies, yet incidents linked to shadow IT, shadow AI and insider behaviour are increasing in frequency and impact.

From employees using personal AI platforms despite sanctioned alternatives, to threat actors exploiting social engineering techniques such as ClickFix to trick staff into executing malicious commands themselves, today’s most damaging incidents often originate from within trusted environments. In many cases, the root cause is not a lack of awareness or controls, but the gap between how organisations expect people to behave and how work is actually done under pressure.

This panel brings together cyber incident response, legal/regulatory and client-side perspectives to explore why shadow risk persists even in mature environments, and what organisations can do differently to address it. Through real world examples and lived experience, the discussion will examine shadow IT, shadow AI and insider risk as human and cultural challenges, not just technical ones. 

The panel will challenge the assumption that more controls automatically lead to better outcomes and will focus instead on how organisations can empower people together, leaders, security teams, legal advisors and staff, to do the right thing when it matters most.

Attendees will leave with a clearer understanding of why traditional approaches fail, how regulators assess "reasonableness" after an incident, and practical steps to reduce shadow risk without undermining productivity or trust.

Key Learning Outcomes

After attending this session, participants will be able to:

• Understand how shadow IT, shadow AI and insider risk now feature as root causes in modern incidents, even in organisations with approved tools and training.
• Recognise how threat actors deliberately exploit human behaviour to bypass technical controls.
• Appreciate the legal and regulatory implications of shadow behaviour, including where responsibility ultimately sits.
• Identify practical, cross disciplinary actions that reduce shadow risk by aligning culture, controls and leadership behaviours.
• Reframe shadow risk as a shared organisational issue that requires empowerment, not enforcement alone.

​